CVE-2024-39698

HIGH
Published Jul 9, 2024 Modified Nov 21, 2024 CWE-154 CWE-295

Description

electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6.

Is your site exposed to CVE-2024-39698?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-154 CWE-154
CWE-295 CWE-295

Affected Products

Vendor Product
electron electron-builder
electron electron-builder
electron electron-builder
electron electron-builder
electron electron-builder
electron electron-builder
electron electron-builder

References

Frequently Asked Questions

What is CVE-2024-39698? +
electron-updater allows for automatic updates for Electron apps. The file `packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts` implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by `cmd.exe` expands any environment variable found in command-line above. This creates a situation where `verifySignature()` can be tricked into validating the certificate of a different file than the one that was just downloaded. If the step is successful, the malicious update will be executed even if its signature is invalid. This attack assumes a compromised update manifest (server compromise, Man-in-the-Middle attack if fetched over HTTP, Cross-Site Scripting to point the application to a malicious updater server, etc.). The patch is available starting from 6.3.0-alpha.6. It has a CVSS v3.1 base score of 7.5 (HIGH).
How severe is CVE-2024-39698? +
CVE-2024-39698 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2024-39698? +
CVE-2024-39698 affects products from electron, specifically: electron-builder. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-39698? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-27303 7.3

electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-39698 — free, no signup required.