CVE-2018-1000006 Remote Code Execution in electron
Attackers can execute arbitrary commands on Windows systems if users click crafted URLs in Electron apps with custom protocol handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000006?
CVE-2018-1000006 is a high-severity command injection vulnerability in n/a, published on 24 Jan 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.
Weakness: CWE-78
Which versions are affected by CVE-2018-1000006?
6 open source packages ship an affected version, including electron. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron npm | From 1.6.0 | 1.6.16 |
electron npm | From 1.6.0 | 1.6.16 |
electron npm | From 1.7.0 | 1.7.11 |
electron npm | From 1.7.0 | 1.7.11 |
electron npm | From 1.8.0 | 1.8.2-beta.4 |
electron npm | From 1.8.0 | 1.8.2-beta.4 |
Products include Atom Electron.
How do I fix CVE-2018-1000006?
Upgrade electron to a fixed version for your release line: 1.6.16, 1.7.11 or 1.8.2-beta.4.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-1000006 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-1000006 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w222-53c6-c86p.