CVE-2024-46992

描述

electron's ASAR Integrity can be bypass by modifying the content. ### Impact This only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are unimpacted. Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. ### Workarounds There are no app side workarounds, you must update to a patched version of Electron. ### Fixed Versions * `30.0.5` * `31.0.0-beta.1` ### For more information If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)

如何修補 CVE-2024-46992

要修補 CVE-2024-46992,請將受影響套件升級到下列已修補版本。

• —升級至 30.0.5 或更新版本

CVE-2024-46992 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 30.0.0-alpha.1, < 30.0.5

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-46992
• PATCHgithub.com/electron/electron
• WEBgithub.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc
• WEBwww.electronjs.org/docs/latest/tutorial/fuses