GHSA-997q-gvvc-jwmx: Medium severity npm/electron vulnerability
Impact Requests to open external protocol URLs could be attributed to a document other than the one that asked for them, so the requestingUrl passed to session.setPermissionRequestHandler was a trusted origin for a launch untrusted content had requested. An origin-based handler could therefore let untrusted content launch an OS-registered external application.
Apps are only affected if they grant openExternal based on the requesting origin and let untrusted content open or navigate windows. Apps whose permission handler denies openExternal for untrusted content are not affected.
Workarounds Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.
Fixed Versions 45.0.0-alpha.5 44.3.0 43.7.0 42.11.3
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Configuration
Deny the openExternal permission for untrusted content, or deny the windows it opens with setWindowOpenHandler.
Electron openExternal permission / setWindowOpenHandler = deny
Event History
Frequently Asked Questions
Which applications are affected by this issue?
Applications are affected only if their permission handler grants openExternal based on the requesting origin and they allow untrusted content to open or navigate windows. Applications that deny openExternal for untrusted content are not affected.
What must an attacker be able to do to exploit this?
Untrusted content must be able to open or navigate a window and request an external protocol URL. The application must then approve openExternal because the incorrectly attributed requesting URL appears to be a trusted origin.
What can be done if updating Electron is not immediately possible?
Deny the openExternal permission for untrusted content. Alternatively, deny windows opened by untrusted content using setWindowOpenHandler.
Which Electron releases contain fixes?
Fixed releases are 45.0.0-alpha.5, 44.3.0, 43.7.0, and 42.11.3.