netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-8xwg-wv7v-4vqp

Browse Source
This commit is contained in:
advisory-database[bot]
2023-09-13 19:08:06 +00:00
parent b088d35884
commit d74612f93f
1 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2018/03/GHSA-8xwg-wv7v-4vqp/GHSA-8xwg-wv7v-4vqp.json
+17 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8xwg-wv7v-4vqp",
"modified": "2023-03-31T18:21:31Z",
"modified": "2023-09-13T19:06:52Z",
"published": "2018-03-26T16:41:17Z",
"aliases": [
"CVE-2018-1000136"
],
"summary": "Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration",
"details": "Versions of electron \nA vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.\n\nFor the application to be impacted by this vulnerability it must meet all of these conditions\n\n- Runs on Electron 1.7, 1.8, or a 2.0.0-beta\n- Allows execution of arbitrary remote code\n- Disables Node.js integration\n- Does not explicitly declare webviewTag: false in its webPreferences\n- Does not enable the nativeWindowOption option\n- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag\n\n\n## Recommendation\n\nUpdate to `electron` version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later.\n\nIf you are unable to update your Electron version can mitigate the vulnerability with the following code.\n\n```\napp.on('web-contents-created', (event, win) => {\n win.on('new-window', (event, newURL, frameName, disposition,\n options, additionalFeatures) => {\n if (!options.webPreferences) options.webPreferences = {};\n options.webPreferences.nodeIntegration = false;\n options.webPreferences.nodeIntegrationInWorker = false;\n options.webPreferences.webviewTag = false;\n delete options.webPreferences.preload;\n })\n})\n\n// and *IF* you don't use WebViews at all,\n// you might also want\napp.on('web-contents-created', (event, win) => {\n win.on('will-attach-webview', (event, webPreferences, params) => {\n event.preventDefault();\n })\n})\n```",
"details": "A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.\n\nFor the application to be impacted by this vulnerability it must meet all of these conditions\n\n- Runs on Electron 1.7, 1.8, or a 2.0.0-beta\n- Allows execution of arbitrary remote code\n- Disables Node.js integration\n- Does not explicitly declare webviewTag: false in its webPreferences\n- Does not enable the nativeWindowOption option\n- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag\n\n\n## Recommendation\n\nUpdate to `electron` version 1.7.13, 1.8.4, or 2.0.0-beta.5 or later.\n\nIf you are unable to update your Electron version can mitigate the vulnerability with the following code.\n\n```js\napp.on('web-contents-created', (event, win) => {\n win.on('new-window', (event, newURL, frameName, disposition,\n options, additionalFeatures) => {\n if (!options.webPreferences) options.webPreferences = {};\n options.webPreferences.nodeIntegration = false;\n options.webPreferences.nodeIntegrationInWorker = false;\n options.webPreferences.webviewTag = false;\n delete options.webPreferences.preload;\n })\n})\n\n// and *IF* you don't use WebViews at all,\n// you might also want\napp.on('web-contents-created', (event, win) => {\n win.on('will-attach-webview', (event, webPreferences, params) => {\n event.preventDefault();\n })\n})\n```",
"severity": [
{
"type": "CVSS_V3",
@@ -20,6 +20,11 @@
"ecosystem": "npm",
"name": "electron"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -39,6 +44,11 @@
"ecosystem": "npm",
"name": "electron"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",
@@ -58,6 +68,11 @@
"ecosystem": "npm",
"name": "electron"
},
"ecosystem_specific": {
"affected_functions": [
""
]
},
"ranges": [
{
"type": "ECOSYSTEM",