electron-updater 2.16.0 vulnerabilities

Known vulnerabilities in the electron-updater package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
H Improper Verification of Cryptographic Signature electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the `windowsExecutableCodeSignatureVerifier` process. An attacker in control of an update manifest - via server compromise or other exploitation - can bypass signature verification of a downloaded file by tricking the application into verifying the signature on a different file instead. Note: This is only exploitable on Windows. How to fix Improper Verification of Cryptographic Signature? Upgrade `electron-updater` to version 6.3.0-alpha.6 or higher.	<6.3.0-alpha.6
M Signature Validation Bypass electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s `publisherName` and the certificate’s `Common Name` attribute of the update binary. During a software update, the application will request a file named `latest.yml` from the update server, which contains the definition of the new release - including the binary filename and hashes. Using a filename containing a backtick (`), among other symbols and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script. This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities. Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle. A partial fix has been made available, blacklisting a small set of characters, but there are additional characters that can be used to exploit this vulnerability. How to fix Signature Validation Bypass? Upgrade `electron-updater` to version 4.3.1 or higher.	<4.3.1
M Signature Validation Bypass electron-updater is a module allowing applications to implement auto-update functionality. Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s `publisherName` and the certificate’s `Common Name` attribute of the update binary. During a software update, the application will request a file named `latest.yml` from the update server, which contains the definition of the new release - including the binary filename and hashes. Using a filename containing a single quote and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script. This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities. Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle. How to fix Signature Validation Bypass? Upgrade `electron-updater` to version 4.2.2 or higher.	<4.2.2

Vulnerability

Vulnerable Version

Improper Verification of Cryptographic Signature

electron-updater is a module allowing applications to implement auto-update functionality.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the windowsExecutableCodeSignatureVerifier process. An attacker in control of an update manifest - via server compromise or other exploitation - can bypass signature verification of a downloaded file by tricking the application into verifying the signature on a different file instead.

Note: This is only exploitable on Windows.

How to fix Improper Verification of Cryptographic Signature?

Upgrade electron-updater to version 6.3.0-alpha.6 or higher.

<6.3.0-alpha.6

Signature Validation Bypass

electron-updater is a module allowing applications to implement auto-update functionality.

Affected versions of this package are vulnerable to Signature Validation Bypass. The signature verification check is based on a string comparison between the installed binary’s publisherName and the certificate’s Common Name attribute of the update binary. During a software update, the application will request a file named latest.yml from the update server, which contains the definition of the new release - including the binary filename and hashes.

Using a filename containing a backtick (`), among other symbols and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script.

This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities.

Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle.

A partial fix has been made available, blacklisting a small set of characters, but there are additional characters that can be used to exploit this vulnerability.

How to fix Signature Validation Bypass?

Upgrade electron-updater to version 4.3.1 or higher.

<4.3.1

Signature Validation Bypass

electron-updater is a module allowing applications to implement auto-update functionality.

Using a filename containing a single quote and a matching hash, an attacker could bypass the entire signature verification by triggering a parse error in the script.

This can be leveraged to force a malicious update on Windows clients, effectively gaining code execution and persistence capabilities.

Exploitation of this vulnerability requires the attacker to also have control over the update server, or alternatively a man-in-the-middle.

How to fix Signature Validation Bypass?

Upgrade electron-updater to version 4.2.2 or higher.

<4.2.2

electron-updater@2.16.0 vulnerabilities

Cross platform updater for electron applications

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?