Pwning Electron Application : Analysis and Defense of Vulnerabilities in Electron Applications
summary
Unpacks many Electron ASARs using an asar brute‑fix script that changes file size until extraction works, and forces developer tools open with devron; finds concrete flaws: custom schemes with allowCORS that leak cookies, openExternal/openURL sanitizers bypassed via prototype pollution, iframe sandbox/top navigation enabling top‑level API escalation, and an exploit chain that uses induced user interaction plus a PowerShell payload to disable Defender and run binaries. Results: 10 RCE cases, 2 local file leaks, 1 CSRF, 1 info disclosure; recommends static scanners and framework fixes.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:08What is Electron
- 3:37Security options
- 4:41Electron vulnerabilities
- 5:42Static analysis
- 7:35Dynamic analysis
- 8:20ASAR protection
- 9:50Bypassing dev tools
- 10:36Collab app vulns
- 12:26XSS in chat
- 13:07Extension vulns
- 15:25File access risks
- 17:03Extension logic bugs
- 18:36Markdown app vulns
- 21:10Remote code execution
- 24:54Vulnerabilities summary
- 25:19Project outcomes
- 26:22Security recommendations
related talks
48mPreloading Insecurity In Your Electron
39mElectron - Build cross platform desktop XSS, it’s easier than you think
23mJavaScript attack surface
50mModern WebApp Vulnerabilities
34mJS Security - A Pentesters Perspective
58mModern web application bugs
24mBitcoin Web Application Security
55mBreaking and Fixing Web Application Security