ASAR Integrity bypass via filetype confusion in electron

CVE-2023-44402 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the resources folder in your app installation on Windows which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

  • 27.0.0-alpha.7
  • 26.2.1
  • 25.8.1
  • 24.8.3
  • 22.3.24

For more information

If you have any questions or comments about this advisory, email us at [email protected]

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2023-12-01 21:32:06 UTC
Updated
2024-09-18 20:13:42 UTC
GitHub reviewed
2023-12-01 21:32:06 UTC
NVD published
2023-12-01

EPSS Score

Score Percentile
0.11% 30.04%

CVSS Scores

Base score Version Severity Vector
6.1 3.1 —
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L)
Some sensitive info could get out, but not a total data dump.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:L)
Might cause slowdowns, glitches, or partial disruption—not a full brick.

Identifiers

Type Value
GHSA GHSA-7m48-wc93-9g85 ↗
CVE CVE-2023-44402 ↗

CWEs

CWE id Name
CWE-345 Insufficient Verification of Data Authenticity

Credits

  • MarshallOfSound (reporter)

Affected packages (6)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
npm electron < 22.3.24 22.3.24 —
npm electron >= 24.0.0-alpha.1, < 24.8.3 24.8.3 —
npm electron >= 25.0.0-alpha.1, < 25.8.1 25.8.1 —
npm electron >= 26.0.0-alpha.1, < 26.2.1 26.2.1 —
npm electron >= 27.0.0-alpha.1, < 27.0.0-alpha.7 27.0.0-alpha.7 —
npm electron >= 23.0.0-alpha.1, <= 23.3.13 — —

References

cvelogic Threat Intelligence