CVE-2017-12581

{"id": "CVE-2017-12581", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2017-08-06T02:29:00.227", "references": [{"url": "https://blog.doyensec.com/2017/08/03/electron-framework-security.html", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.doyensec.com/2017/08/03/electron-framework-security.html", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://doyensec.com/resources/us-17-Carettoni-Electronegativity-A-Study-Of-Electron-Security.pdf", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy (SOP) is a precondition; however, recent Electron versions do not have strict SOP enforcement. Combining an SOP bypass with a privileged URL internally used by Electron, it was possible to execute native Node.js primitives in order to run OS commands on the user's host. Specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a Node.js child_process.execFile API call."}, {"lang": "es", "value": "GitHub Electron en versiones anteriores a la 1.6.8 permite la ejecuci\u00f3n remota de comandos debido a una vulnerabilidad de omisi\u00f3n de nodeIntegration. Esta vulnerabilidad tambi\u00e9n afecta a todas las aplicaciones que incluyen c\u00f3digo Electron equivalentes a la versi\u00f3n 1.6.8 o anteriores. Omitir la Same Origin Policy (SOP) es un prerrequisito. Sin embargo, las versiones recientes de Electron no tienen un cumplimiento estricto de esta pol\u00edtica. Mediante la combinaci\u00f3n de una omisi\u00f3n de SOP y una URL con privilegios empleada internamente por Electron, fue posible ejecutar primitivos Node.js nativos para ejecutar comandos del sistema operativo en el host del usuario. Concretamente, se podr\u00eda emplear una ventana chrome-devtools://devtools/bundled/inspector.html para evaluar una llamada API a Node.js child_process.execFile."}], "lastModified": "2024-11-21T03:09:47.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:electron:electron:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90D309B0-C178-4ACC-8C59-B8C29762C9F9", "versionEndIncluding": "1.6.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}