Untrusted Search Path Affecting app-builder-lib package, versions <24.13.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-APPBUILDERLIB-6371201
- published 5 Mar 2024
- disclosed 4 Mar 2024
- credit Bruno Badaró
Introduced: 4 Mar 2024
CVE-2024-27303 Open this link in a new tabHow to fix?
Upgrade app-builder-lib to version 24.13.2 or higher.
Overview
app-builder-lib is an electron-builder lib
Affected versions of this package are vulnerable to Untrusted Search Path due to the NSIS installer making a system call to open cmd.exe via NSExec in the .nsh installer script. An attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.
Notes:
This is only exploitable on Windows machines.
NSExecby default searches the current directory of where the installer is located before searchingPATH.