0

Electron is a "web application writing platform" used by software such as Skype and Slack for Windows (among many others). News articles from today are purporting that these applications are now vulnerable to remote code execution due to vulnerabilities in the Electron framework itself.

I am running Skype on my Windows machine. It registers itself as the default handler for a protocol (lets say skype://). It is not running as a service. How am I susceptible to remote code execution if the software is not running as a service? What steps would need to happen for RCE to happen... namely would I have to click on a link? Would an attacker have to initiate a skype conversation with me in order to trigger the exploit?

Further is the attack mechanism the same for every piece of software affected or is it a different attack vector for every piece of software?


EDIT: Looking through the release notes and source code commits, I noticed this change.

Electron source code change

It seems to imply the attack vector would be a specially crafted 'launching' uri (taking advantage of the default handler). If that's true though it makes me think the user would either have to click this link or visit a website that redirects to the link. Can somebody confirm?

2

According to the CVE RCE is triggered when a specially crafted URL is clicked that will be handled by Electron. The vulnerability is only for Windows, and does not affect macOS or Linux. See the Electron team's blog post for more details.

  • Do you know if its possible to redirect to such a link (i.e. if you visit a malicious http website)? – n00b Jan 25 '18 at 15:26
  • It is possible to redirect to other protocols from http. Generally the browser and/or system would give you a warning asking you if you want to open the link, but this may depend on configuration. It would be best to test this on links that you know aren't malicious. – AndrolGenhald Jan 25 '18 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.