Internet Bug Bounty · Report #2271095

ASAR Integrity bypass via filetype confusion

Validstatus

mediumseverity

$2,540bounty

49upvotes

20 Jan 2024disclosed

Summary

ASAR Integrity bypass via filetype confusion Severity: Medium

Full GHSA: https://github.com/electron/electron/security/advisories/GHSA-7m48-wc93-9g85

How it was found

Maliciously crafted directories mirroring an ASAR file structure could be used to trick apps with ASAR integrity enabled into loading non-validated code.

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to macOS as these fuses are only currently supported on macOS.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against.

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

27.0.0-alpha.7
26.2.1
25.8.1
24.8.3
22.3.24

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original