Internet Bug Bounty · Report #1519099
Renderers can obtain access to random bluetooth device without permission
Summary
Renderers can obtain access to random bluetooth device without permission Description Impact This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device.
All current stable versions of Electron are affected.
Patches This has been patched and the following Electron versions contain the fix:
17.0.0-alpha.6 16.0.6 15.3.5 14.2.4 13.6.6
Workarounds can be found in the security advisory linked below.
For more information If you have any questions or comments about this advisory, email us at [email protected].
https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749
How it was found
With the default configuration in Electron, renderer processes (which should not have access to system resources by default) can gain read/write access to a nearby bluetooth device. To reproduce:
- Run the electron-quick-start app with a vulnerable version of Electron: https://github.com/electron/electron-quick-start
- Using the developer tools, run
await navigator.bluetooth.requestDevice({acceptAllDevices: true}) - You should get a permission error, but in vulnerable versions you will get a bluetooth device object instead.
Impact
If an Electron app loads remote or untrusted content in a renderer process (which is normally fine, as the process should not have any privileges), the remote content would have read/write access to nearby bluetooth devices. The impact would then depend on what devices the user has nearby.