CVE-2018-1000006

描述

Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met: 1. The electron application is running on Windows. 2. The electron application registers as the default handler for a protocol, such as `nodeapp://`. This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron. MacOS and Linux are not vulnerable. ## Recommendation Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance: If for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted. ``` app.setAsDefaultProtocolClient(protocol, process.execPath, [ '--your-switches-here', '--' ]) ```

如何修補 CVE-2018-1000006

要修補 CVE-2018-1000006,請將受影響套件升級到下列已修補版本。

• —升級至 1.7.11 或更新版本

CVE-2018-1000006 正在被利用嗎?

可能 — EPSS 為 84.4%,屬於高被利用機率區間,建議優先修補。

受影響套件(1)

• >= 1.7.0, < 1.7.11

CVSS 分數

參考連結(9)

• ADVISORYgithub.com/advisories/GHSA-w222-53c6-c86p
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-1000006
• WEBwww.securityfocus.com/bid/102796
• WEBelectronjs.org/blog/protocol-handler-fix
• WEB