I'm curious about the actual dangers of executing
shell.openExternal on untrusted content. Documentation specifically states that this can be leveraged for RCE:
Improper use of openExternal can be leveraged to compromise the user's host. When openExternal is used with untrusted content, it can be leveraged to execute arbitrary commands.
All reports I can find of this online claim they have RCE by popping open the Calculator application or opening
/etc/passwd in a text editor. But none of these are actually remote code execution. Yes, RCE vulnerabilities are often PoC'ed by popping open the calculator app, but popping open the calculator app does not mean you have an RCE: these are merely the execution of local code that is already there on the victim's filesystem, or opening files already on the victim's filesystem in their default application. I don't see how you could use this ability to compromise a user's host, and I have yet to find an example of an actual RCE exploit or vulnerability caused by executing
shell.openExternal on untrusted content.
From documentation and experimentation, it seems that
shell.openExternal works by essentially opening a url, file, or binary in the application that your system would normally use to run it. You can't pass arguments, so invoking a shell is not particularly useful. As best as I can tell, exploiting this for an actual RCE would require first dropping the malicious binary on the target's filesystem at a predictable location. Note that uploading a malicious binary to the Internet and pointing to it via a URL does not work -- it just results in a browser opening and offering the file for download.
So lets say I'm running an electron app which calls
shell.openExternal(value); where you control
value. How would you execute your arbitrary code / commands on my machine?