GHSA-3P22-GHQ8-V749
Vulnerability from github – Published: 2022-03-22 18:49 – Updated: 2022-03-22 18:49
VLAI?
Summary
Renderers can obtain access to random bluetooth device without permission in Electron
Details
Impact
This vulnerability allows renderers to obtain access to a random bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device.
All current stable versions of Electron are affected.
Patches
This has been patched and the following Electron versions contain the fix:
* 17.0.0-alpha.6
* 16.0.6
* 15.3.5
* 14.2.4
* 13.6.6
Workarounds
Adding this code to your app can workaround the issue.
app.on('web-contents-created', (event, webContents) => {
webContents.on('select-bluetooth-device', (event, devices, callback) => {
// Prevent default behavior
event.preventDefault();
// Cancel the request
callback('');
});
});
For more information If you have any questions or comments about this advisory, email us at security@electronjs.org.
Severity ?
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "13.6.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "14.0.0-beta.1"
},
{
"fixed": "14.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.0-beta.1"
},
{
"fixed": "15.3.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0-beta.1"
},
{
"fixed": "16.0.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 17.0.0-alpha.5"
},
"package": {
"ecosystem": "npm",
"name": "electron"
},
"ranges": [
{
"events": [
{
"introduced": "17.0.0-alpha.1"
},
{
"fixed": "17.0.0-alpha.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21718"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-22T18:49:36Z",
"nvd_published_at": "2022-03-22T17:15:00Z",
"severity": "LOW"
},
"details": "### Impact\nThis vulnerability allows renderers to obtain access to a random bluetooth device via the [web bluetooth API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API) if the app has not configured a custom `select-bluetooth-device` event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device.\n\nAll current stable versions of Electron are affected.\n\n### Patches\nThis has been patched and the following Electron versions contain the fix:\n* `17.0.0-alpha.6`\n* `16.0.6`\n* `15.3.5`\n* `14.2.4`\n* `13.6.6`\n\n### Workarounds\nAdding this code to your app can workaround the issue.\n\n```js\napp.on(\u0027web-contents-created\u0027, (event, webContents) =\u003e {\n webContents.on(\u0027select-bluetooth-device\u0027, (event, devices, callback) =\u003e {\n // Prevent default behavior\n event.preventDefault();\n // Cancel the request\n callback(\u0027\u0027);\n });\n});\n```\n\nFor more information\nIf you have any questions or comments about this advisory, email us at security@electronjs.org.",
"id": "GHSA-3p22-ghq8-v749",
"modified": "2022-03-22T18:49:36Z",
"published": "2022-03-22T18:49:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21718"
},
{
"type": "WEB",
"url": "https://github.com/electron/electron/pull/32178"
},
{
"type": "WEB",
"url": "https://github.com/electron/electron/pull/32240"
},
{
"type": "PACKAGE",
"url": "https://github.com/electron/electron"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Renderers can obtain access to random bluetooth device without permission in Electron"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…