News

VS Code Susceptible to Electron-Based Vulnerability

Visual Studio Code, being based on the open source Electron framework, is among applications susceptible to a remote code execution vulnerability just patched by the Electron team this week.

New editions of Electron, developed by GitHub, were shipped to provide a fix. (Update: As noted in the comments section, VS Code users who update to version 1.19 are protected from this vulnerability. The release notes for that version state: "This update also includes a fix for an Electron security vulnerability.")

"A remote code execution vulnerability has been discovered affecting Electron apps that use custom protocol handlers," the team said in a blog post this week. "This vulnerability has been assigned the CVE identifier CVE-2018-1000006.

That Common Vulnerability and Exposures entry says:

GitHub Electron versions 1.8.2-beta.3 and earlier, 1.7.10 and earlier, 1.6.15 and earlier has a vulnerability in the protocol handler, specifically Electron apps running on Windows 10, 7 or 2008 that register custom protocol handlers can be tricked in arbitrary command execution if the user clicks on a specially crafted URL. This has been fixed in versions 1.8.2-beta.4, 1.7.11, and 1.6.16.

The vulnerability affects only Windows-based apps -- not macOS or Linux -- and VS Code is among Electron-based apps listed on the Electron site. Other popular programs said to be at risk include Skype, Slack, WordPress and GitHub's Atom code editor.

"We've published new versions of Electron which include fixes for this vulnerability: 1.8.2-beta.4, 1.7.11, and 1.6.16. "We urge all Electron developers to update their apps to the latest stable version immediately.

"If for some reason you are unable to upgrade your Electron version, you can append -- as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options. The double dash -- signifies the end of command options, after which only positional parameters are accepted."

The Electron post said the vulnerability affects Windows-based Electron apps that register themselves as the default handler for a protocol, such as: "myapp://".

Apps reportedly can be affected no matter how the protocol is registered, via native code, the Windows registry or the aforementioned app.setAsDefaultProtocolClient API.

The Windows Defender Security Intelligence team on Tuesday tweeted that the "recent protocol handler bug disclosed by Electror" was spotted by the Windows Defender Advanced Threat Protection tool.

About the Author

David Ramel is an editor and writer for Converge360.

comments powered by Disqus

Featured

  • How Latest Visual Studio 2022 Update Speeds Code Search

    The recently released Visual Studio 2022 17.1 Preview 3 improves code search even more than gains made in the jump from VS 2019 to VS 2022.

  • Visual Studio 2022 for Mac Dumps Mono for .NET 6

    Visual Studio 2022 for Mac has parted ways with the Mono runtime in the just-published Preview 5, now running on .NET 6.

  • .NET Community Toolkit v8.0 Preview Revamps MVVM Library

    Microsoft announced the first preview of .NET Community Toolkit v8.0.0, which revamps the MVVM library and introduces a new GitHub repo to host the project.

  • Microsoft Details Native Integration of Elastic on Azure

    Microsoft detailed the native integration of Elastic tech with its Azure cloud computing platform, increasing application observability.

Upcoming Events