CVE-2024-27303 electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)
An attacker can execute arbitrary code on Windows by placing a malicious cmd.exe in the installer directory, exploiting unsafe path resolution in electron-builder.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-27303?
CVE-2024-27303 is a high-severity command injection vulnerability in electron-userland electron-builder, published on 6 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
Which versions are affected by CVE-2024-27303?
2 open source packages ship an affected version, including app-builder-lib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
app-builder-lib npm | All versions | 24.13.2 |
app-builder-lib npm | All versions | 24.13.2 |
Linux distribution packages (1)
teleport openSUSE:Tumbleweed | All versions | 15.1.6-1.1 |
Products include Electron Electron-Builder.
How do I fix CVE-2024-27303?
Upgrade app-builder-lib to 24.13.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-27303 being exploited?
There is no known exploitation of CVE-2024-27303 in the wild and no public exploit code.
Other vulnerabilities in electron-userland electron-builder
Sources
Also known as GHSA-r4pf-3v7r-hh55, openSUSE-SU-2024:13782-1.