CWE Code: 78
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary: github electron before 1.6.8 allows remote command execution because of a nodeintegration bypass vulnerability. this also affects all applications that bundle electron code equivalent to 1.6.8 or earlier. bypassing the same origin policy (sop) is a precondition; however, recent electron versions do not have strict sop enforcement. combining an sop bypass with a privileged url internally used by electron, it was possible to execute native node.js primitives in order to run os commands on the user's host. specifically, a chrome-devtools://devtools/bundled/inspector.html window could be used to eval a node.js child_process.execfile api call.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-08-06
Last Modified Date: 2017-08-14