CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6
Attackers can bypass Windows code signature verification in electron-updater to execute malicious updates if the update manifest is compromised.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-39698?
CVE-2024-39698 is a high-severity vulnerability in electron-userland electron-builder, published on 9 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.
Which versions are affected by CVE-2024-39698?
2 open source packages ship an affected version, including electron-updater. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
electron-updater npm | All versions | 6.3.0-alpha.6 |
electron-updater npm | All versions | 6.3.0-alpha.6 |
Products include Electron Electron-Builder.
How do I fix CVE-2024-39698?
Upgrade electron-updater to 6.3.0-alpha.6 or later.
Is CVE-2024-39698 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39698 exists.
Other vulnerabilities in electron-userland electron-builder
Sources
Also known as GHSA-9jxc-qjr9-vjxq.