CVE-2020-4075: Arbitrary file read via window-open IPC in Electron

Background

Electron is an open-source framework that allows developers to build cross-platform desktop applications using web technologies such as HTML, CSS, and JavaScript. It provides a runtime environment for creating native-like applications for Windows, macOS, and Linux. However, Electron is vulnerable to an arbitrary file read vulnerability when defining unsafe window options on a child window opened via window.open.

Vulnerability Detail

The vulnerability in Electron allows an attacker to read arbitrary local files by exploiting the unsafe window options on a child window opened via window.open. By manipulating the options of the window, an attacker can bypass security measures and gain unauthorized access to sensitive files on the user's system. This can lead to the exposure of confidential information and potential further attacks.

npm install electron@45.0.0

Workaround

A workaround for this vulnerability is to call event.preventDefault() on all new-window events where the url or options is not expected. This will prevent the child window from opening and executing the potentially malicious code. Here is an example of how to implement this workaround in Electron:

const { app, BrowserWindow } = require('electron');

app.on('ready', () => {
  const mainWindow = new BrowserWindow();

  mainWindow.webContents.on('new-window', (event, url, frameName, disposition, options) => {
    // Check if the URL or options are expected
    if (/* URL or options are not expected */) {
      event.preventDefault();
    }
  });
});

Conclusion

In conclusion, the arbitrary file read vulnerability in Electron can lead to unauthorized access to sensitive files on the user's system. It is crucial to update Electron to the fixed versions and implement the recommended workaround to mitigate the risk. Regularly updating dependencies and following security best practices is essential to ensure the security of Electron-based applications.

See every vulnerability recorded for electron →

FAQ