GHSA-fw47-9c62-h3vw: Medium severity npm/electron vulnerability
Impact For hid and usb permission checks made from an iframe, session.setPermissionCheckHandler was given the top-level frame's origin and details instead of the requesting frame's. Apps that allow these permissions based on origin could grant an embedded frame access intended for the top-level page.
You're only affected if you use setPermissionCheckHandler with origin-based logic for hid or usb and embed cross-origin iframes with allow="hid" or allow="usb". Apps that don't delegate those features to untrusted iframes are not affected.
Workarounds Don't add allow="hid" / allow="usb" to untrusted iframes, or make the decision in your select-hid-device / select-usb-device handler using details.frame.
Fixed Versions 45.0.0-alpha.5 44.3.0 43.7.0 42.11.3
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
npm/electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 42.11.3 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 43.7.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 44.3.0 - Upgrade
Upgrade
Electronto a version that resolves this vulnerability.Fixed in 45.0.0-alpha.5 - Configuration
Do not add allow="hid" or allow="usb" to untrusted iframes; for hid and usb permission checks, make the decision in the select-hid-device or select-usb-device handler using details.frame.
Electron iframe permissions allow="hid" / allow="usb" = do not delegate to untrusted iframes
Event History
Frequently Asked Questions
Which applications are actually exposed?
Applications are affected only if they use session.setPermissionCheckHandler with origin-based decisions for HID or USB and embed cross-origin iframes granted allow="hid" or allow="usb". Applications that do not delegate these features to untrusted iframes are not affected.
What access could an embedded frame gain?
A cross-origin iframe may be granted HID or USB access that the application intended to allow only for the top-level page, because the permission-check handler receives the top-level frame's origin and details rather than the requesting frame's.
What can be done before upgrading?
Do not add allow="hid" or allow="usb" to untrusted iframes. Alternatively, make HID and USB authorization decisions in the select-hid-device or select-usb-device handler using details.frame.
Which versions contain the fix?
The issue is fixed in 45.0.0-alpha.5, 44.3.0, 43.7.0, and 42.11.3.