Preloading Insecurity In Your Electron
summary
Demonstrates concrete chains that turn an Electron XSS into RCE by abusing BrowserWindow preload: examples hijack Wire’s logger to write files (overwriting .bashrc to spawn a calculator), use Discord’s bundled native modules and a require-via-IPC channels trick to run child_process, and use prototype pollution against preloads lacking contextIsolation to recover process and require. Counts show 12 historical nodeIntegration bypasses, scans find >80% apps enable nodeIntegration while only ~25% use contextIsolation; recommends VM contexts or postMessage plus enabling sandbox and contextIsolation.
AI-written summary · about
chapters (30)
- 0:00Intro
- 3:59Anatomy of Electron-based Apps
- 4:27Lifecycle
- 7:13ContextIsolation 1/2
- 9:56Electron is NOT a browser
- 10:43From Browser to Electron - Attack Surface
- 12:36From Browser to Electron- Isolation
- 14:02Full chain exploit (Step 1)
- 15:23Cross-Site Scripting
- 16:29Full chain exploit (Step 2)
- 17:40nodelntegration bypasses
- 18:15Affected Configs
- 19:15Exploits
- 19:32Secure-by-Default Settings (v5)
- 20:06Chromium Upgrades
- 20:24Survey Results
- 22:29preload - A neglected attack surface
- 23:27Node's Buffer
- 24:39Case Study - Wire App 1/3
- 28:30Case Study - Discord 3/3
- 30:20IpcMain and ipcRenderer 1/2
- 31:49Leveraging the Internal Electron IPC
- 32:40Case Study - (Again) Discord 3/3
- 35:24Sandboxing 2/2
- 37:16Native Capabilities, and Your Responsibility
- 38:13Prototype Pollution - Preload
- 38:48Case Study - Undisclosed 2/3
- 40:35Prototype Pollution - Electron
- 43:04Making Preload works with ContextIsolation
- 44:10Black Hat Sound Bytes 2/3
related talks
39mElectron - Build cross platform desktop XSS, it’s easier than you think
27mPwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications
23mJavaScript attack surface
32mWriting Secure JavaScript Code
34m"The magic of XSS - not only in web applications"
34mJS Security - A Pentesters Perspective
40mHostile JavaScript: Attacking and Defending the Browser
56mModern Web Vulnerabilities 2020