Packages / electron / Security

ModerateVulnerabilityGHSA-p2jh-44qj-pf2vCVE-2022-36077Published 10 Nov 2022

Exfiltration of hashed SMB credentials on Windows via file:// redirect

Affected releases · electron

  • 20.x20.0.0Fixed in 20.0.1
  • 19.x19.0.0 – 19.0.10Fixed in 19.0.11
  • 18.x18.0.0 – 18.3.6Fixed in 18.3.7
  • 17.x and older0.1.0 – 17.4.11No fix, no longer updated

On 20.x, the newest line:

npm install electron@20.0.1
45.x

  1. Not affected

    45.0.0

    1 release, latest

20.x

  1. Affected

    20.0.0

    1 release

  2. Fixed

    20.0.1 – 20.3.12

    22 releases

19.x

  1. Affected

    19.0.0 – 19.0.10

    11 releases

  2. Fixed

    19.0.11 – 19.1.9

    17 releases

18.x

  1. Affected

    18.0.0 – 18.3.6

    17 releases

  2. Fixed

    18.3.7 – 18.3.15

    8 releases

17.x

  1. Affected

    17.0.0 – 17.4.11

    20 releases

16.x

  1. Affected

    16.0.0 – 16.2.8

    22 releases

15.x

  1. Affected

    15.0.0 – 15.5.7

    24 releases

14.x

  1. Affected

    14.0.0 – 14.2.9

    15 releases

13.x

  1. Affected

    13.0.0 – 13.6.9

    29 releases

12.x

  1. Affected

    12.0.0 – 12.2.3

    26 releases

11.x

  1. Affected

    11.0.0 – 11.5.0

    27 releases

10.x

  1. Affected

    10.0.0 – 10.4.7

    22 releases

9.x

  1. Affected

    9.0.0 – 9.4.4

    22 releases

8.x

  1. Affected

    8.0.0 – 8.5.5

    25 releases

7.x

  1. Affected

    7.0.0 – 7.3.3

    26 releases

6.x

  1. Affected

    6.0.0 – 6.1.12

    26 releases

5.x

  1. Affected

    5.0.0 – 5.0.13

    14 releases

4.x

  1. Affected

    4.0.0 – 4.2.12

    28 releases

3.x

  1. Affected

    3.0.0 – 3.1.13

    31 releases

2.x

  1. Affected

    2.0.0 – 2.0.18

    19 releases

1.x

  1. Affected

    1.3.1 – 1.8.8

    79 releases

0.x

  1. Affected

    0.1.0 – 0.4.1

    8 releases

1131 stable releases of electron, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for electron. It is read in your browser and sent nowhere.

What happens

Impact

When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as file://some.website.com/, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.

Patches

This issue has been fixed in all current stable versions of Electron. Specifically, these versions contain the fixes:

  • 21.0.0-beta.1

  • 20.0.1

  • 19.0.11

  • 18.3.7

We recommend all apps upgrade to the latest stable version of Electron.

Workarounds

If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the WebContents.on('will-redirect') event, for all WebContents:

app.on('web-contents-created', (e, webContents) => {
  webContents.on('will-redirect', (e, url) => {
    if (/^file:/.test(url)) e.preventDefault()
  })
})

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org.

Credit

Thanks to user @coolcoolnoworries for reporting this issue.