SSL Validation Defaults to False in electron-packager

Affected versions of electron-packager configure the generated application to disable SSL certificate verification by default. This could allow an attacker with a privileged network position to launch a Man In The Middle MITM attack on the install process, intercepting the step where...

Electronegativity - Tool To Identify Misconfigurations And Security Anti-Patterns In Electron Applications

Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as described in the "Electron Security Checklist - A Guide for Developers and Auditors" whitepaper...

BEEMKA: Basic Electron Post-Exploitation Framework

PenTestIT RSS Feed There are a lot of applications today that use Electron Framework, as it helps you build cross platform desktop apps with JavaScript, HTML, and CSS. Examples are applications such as Skype, Station, etc. A new post-exploitation framework - BEEMKA can now help you in maintaining...

Fedora Update for electron-cash FEDORA-2018-36320c03cd

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 28 Update: electron-cash-3.3.4-1.fc28

Electron Cash is an easy to use Bitcoin Cash client. It protects you from l osing coins in a backup mistake or computer failure, because your wallet can be recovered from a secret phrase that you can write on paper or learn by heart. There is no waiting time when you start the client, because it...

Fedora 29 : electron-cash (2018-7d6590724e)

Updated to 3.3.4. Security fix by upstream : Anti-Phishing protection.. Server-provided text will not appear in user-facing GUI windows anymore. Server error messages are instead parsed and mapped to predefined strings. Note that Tenable Network Security has extracted the preceding description...

[SECURITY] Fedora 29 Update: electron-cash-3.3.4-1.fc29

Electron Cash is an easy to use Bitcoin Cash client. It protects you from l osing coins in a backup mistake or computer failure, because your wallet can be recovered from a secret phrase that you can write on paper or learn by heart. There is no waiting time when you start the client, because it...

Google Chrome 70 - SQLite Magellan Crash (PoC)

Google Chrome 70 - SQLite Magellan Crash PoC This proof-of-concept crashes the Chrome renderer process using Tencent Blade Team's Magellan SQLite3 bug. It's based on a SQLite test case from the commit that fixed the bug. If you're using Chrome 70 or below, tap the button below to crash this page:...

Google Chrome 70 - SQLite Magellan Crash (PoC)

This proof-of-concept crashes the Chrome renderer process using Tencent Blade Team's Magellan SQLite3 bug. It's based on a SQLite test case from the commit that fixed the bug. If you're using Chrome 70 or below, tap the button below to crash this page: Crash this page Your browser's user agent is...

Remote Code Execution

Overview GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution. More information to...

Brave Software: RCE: DnDing shortcut files to chrome://brave allows loading HTML files in Muon's context

Summary: \395737 has shown that Brave supports chrome://brave/ URLs. The Brave team introduced a patch which blocks navigation to chrome://brave and removed chrome.remote.require to prevent command execution on the machine. Navigation to chrome://brave via shortcut files From my understanding: 1...

The vulnerability of the Electron application development software platform arises from access control errors, which allow a hacker to execute arbitrary code.

The vulnerability of the Electron application development software platform stems from access control errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially crafted iframe element...

Electron WebPreferences - Remote Code Execution Exploit

Exploit for multiple platform in category remote exploits CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested...

Electron WebPreferences - Remote Code Execution

Electron WebPreferences - Remote Code Execution CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windo...

Electron WebPreferences - Remote Code Execution

CVE-2018-15685 - Electron WebPreferences Remote Code Execution This is a minimal Electron application with a POC for CVE-2018-15685. A remote code execution vulnerability has been discovered affecting apps with the ability to open nested child windows on Electron versions 3.0.0-beta.6, 2.0.7,...

Remote Code Execution (RCE)

Electron is vulnerable to remote code execution RCE attacks. When IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" option are used, it is possible for an attacker to launch web preferences vulnerability leading to remote code execution...

@felixrieseberg/electron-prebuilt-compile (>=3.0.0-beta.1 <=3.0.0-beta.13), @getstation/electron-prebuilt-compile (=3.0.0-beta.12) +1 more potentially affected by CVE-2018-15685 via electron (>=3.0.0-beta.1 <=3.0.0-beta.6)

electron NPM version =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.5 Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

4cdl (>=1.0.1 <=1.0.7), 77cli (>=0.0.10 <=0.0.12) +364 more potentially affected by CVE-2018-15685 via electron (>=2.0.0 <=2.0.8-nightly.20180820)

electron NPM version =2.0.0, =1.0.1, =0.0.10, =3.0.5, =0.1.0, =1.0.0, =0.0.2, =0.0.1, =1.0.2, =0.0.1, =1.1.0, =0.0.1, =0.0.5 and more Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

@devpodio/application-manager (>=0.3.16 <=0.3.20), @devpodio/bunyan (>=0.3.16 <=0.3.20) +158 more potentially affected by CVE-2018-15685 via electron (>=1.8.1 <=1.8.7)

electron NPM version =1.8.1, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.16, =0.3.20 and more Source cves: CVE-2018-15685 Source advisory: OSV:GHSA-HV9C-QWQG-QJ3V...

@philipptrenz/photo-booth (>=1.0.1 <=1.0.6), @quarks/bpmn-extension (=1.0.0) +46 more potentially affected by CVE-2018-15685 via electron (>=1.7.0 <=1.7.13)

electron NPM version =1.7.0, =1.0.1, =1.0.0, =1.0.1, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0cc6469e, =0.4.0-next.0b426d22, =0.3.3, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.0b426d22, =0.4.0-next.ff386514 and more...