GHSA-vw94-r84p-66qf: Electrum before 4.7.2 External Plugin Authorization Bypass Local Code Execution
Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Electrumto a version that resolves this vulnerability.Fixed in 4.7.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Electrum installations from 4.6.0 before 4.7.2 are exposed if a rogue local process can write to the Electrum data directory. The attacker must be able to place code in the plugins/ folder and modify the configuration to mark that plugin enabled.
Does an attacker need to interact with the Electrum user or know the plugin password?
No user interaction is described as necessary. The bypass occurs because the external plugin loader executes an enabled plugin's __init__.py without verifying its plugin-password signature.
How can I tell whether an installation may already be affected?
Check whether the Electrum version is 4.6.0 through versions before 4.7.2, and inspect the Electrum data directory for unexpected plugin code in plugins/ and configuration entries that enable those plugins.
What is the immediate mitigation if upgrading is not possible?
Prevent untrusted local processes from writing to the Electrum data directory, especially its plugins/ folder and configuration file. Review and remove unexpected enabled plugins and their files.