CVE-2020-25019 (published 2020-08-29T17:15Z)

jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-345
cwe_name: Insufficient Verification of Data Authenticity
description: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/jitsi/jitsi-meet-electron
commit_details: repo_url: https://github.com/jitsi/jitsi-meet-electron
author: Saúl Ibarra Corretgé
author_date: 2020-06-30 11:16:21+02:00
msg: Share logic for opening external links
repository: repo_url: https://github.com/jitsi/jitsi-meet-electron
repo_name: jitsi/jitsi-meet-electron
description: Jitsi Meet desktop application powered by :electron:
repo_language: JavaScript
owner: jitsi
file_changes: filename: openExternalLink.js
change_type: ModificationType.ADD
diff: @@ -0,0 +1,25 @@
+const { shell } = require('electron');
+const url = require('url');
+
+
+const protocolRegex = /^https?:/i;
+
+/**
+ * Opens the given link in an external browser.
+ *
+ * @param {string} link - The link (URL) that should be opened in the external browser.
+ * @returns {void}
+ */
+export function openExternalLink(link) {
+    let u;
+
+    try {
+        u = url.parse(link);
+    } catch (e) {
+        return;
+    }
+
+    if (protocolRegex.test(u.protocol)) {
+        shell.openExternal(link);
+    }
+}

programming_language: TypeScript
filename: preload.js
change_type: ModificationType.MODIFY
diff: @@ -1,31 +1,9 @@
 const createElectronStorage = require('redux-persist-electron-storage');
-const { ipcRenderer, shell, remote } = require('electron');
+const { ipcRenderer, remote } = require('electron');
 const os = require('os');
-const url = require('url');
-
 const jitsiMeetElectronUtils = require('jitsi-meet-electron-utils');
+const { openExternalLink } = require('../features/utils/openExternalLink');
 
-const protocolRegex = /^https?:/i;
-
-/**
- * Opens the given link in an external browser.
- *
- * @param {string} link - The link (URL) that should be opened in the external browser.
- * @returns {void}
- */
-function openExternalLink(link) {
-    let u;
-
-    try {
-        u = url.parse(link);
-    } catch (e) {
-        return;
-    }
-
-    if (protocolRegex.test(u.protocol)) {
-        shell.openExternal(link);
-    }
-}
 
 const whitelistedIpcChannels = [ 'protocol-data-msg', 'renderer-ready' ];
 
@@ -34,7 +12,6 @@ window.jitsiNodeAPI = {
     osUserInfo: os.userInfo,
     openExternalLink,
     jitsiMeetElectronUtils,
-    shellOpenExternal: shell.openExternal,
     getLocale: remote.app.getLocale,
     ipc: {
         on: (channel, listener) => {

programming_language: JavaScript
filename: main.js
change_type: ModificationType.MODIFY
diff: @@ -4,8 +4,7 @@ const {
     BrowserWindow,
     Menu,
     app,
-    ipcMain,
-    shell
+    ipcMain
 } = require('electron');
 const contextMenu = require('electron-context-menu');
 const debug = require('electron-debug');
@@ -22,6 +21,7 @@ const {
 const path = require('path');
 const URL = require('url');
 const config = require('./app/features/config');
+const { openExternalLink } = require('./app/features/utils/openExternalLink');
 
 const showDevTools = Boolean(process.env.SHOW_DEV_TOOLS) || (process.argv.indexOf('--show-dev-tools') > -1);
 
@@ -211,7 +211,7 @@ function createJitsiMeetWindow() {
 
         if (!target || target === 'browser') {
             event.preventDefault();
-            shell.openExternal(url);
+            openExternalLink(url);
         }
     });
     mainWindow.on('closed', () => {

programming_language: JavaScript
filename: package.json
change_type: ModificationType.MODIFY
diff: @@ -15,8 +15,8 @@
     "validate": "npm ls",
     "watch": "webpack --config ./webpack.renderer.js --mode development --watch --watch-poll"
   },
-  "engines" : {
-    "node" : ">=12.0.0"
+  "engines": {
+    "node": ">=12.0.0"
   },
   "build": {
     "appId": "org.jitsi.jitsi-meet",

programming_language: CoffeeScript