Skype, Slack, other apps inherit Electron vuln

Devs, check your protocol handling, patch if necessary

By Richard Chirgwin

Posted in Security, 24th January 2018 04:01 GMT

Updated If you've built a Windows application on Electron, check to see if it's subject to a just-announced remote code execution vulnerability.

Electron is a node.js and Chromium framework that lets developers use Web technologies (JavaScript, HTML and CSS) to build desktop apps. It's widely-used: Skype, Slack, Signal, a Basecamp implementation and a desktop Wordpress app all count themselves as adopters.

Slack users should update to version 3.0.3 or better, and the latest version of Skype for Windows is protected, Microsoft told Cyberscoop.

Electron has only published limited details of CVE-2018-1000006, but it affects Windows applications that use custom protocol handlers in the framework.

Here's what the advisory has to say:

“Electron apps designed to run on Windows that register themselves as the default handler for a protocol, like myapp://, are vulnerable.

“Such apps can be affected regardless of how the protocol is registered, e.g. using native code, the Windows registry, or Electron's app.setAsDefaultProtocolClient API.

A ray of sunshine to close: “macOS and Linux are not vulnerable to this issue”, Electron's developers said.

The advisory doesn't give any indication how many apps make themselves the default protocol handler.

Electron has pushed out two patched versions: 1.8.2-beta.4, 1.7.11, and 1.6.16, and: “If for some reason you are unable to upgrade your Electron version, you can append -- as the last argument when calling app.setAsDefaultProtocolClient, which prevents Chromium from parsing further options.” ®

Updated to add

Signal reckons it's not affected:

Sign up to our NewsletterGet IT in your inbox daily

7 Comments

More from The Register

Skype for Biz users: Go watch nature vids. Microsoft wants you to get good at migration

New roadmap for Teams does everything but name Skype's death date

That terrifying 'unfixable' Microsoft Skype security flaw: THE TRUTH

Oh yeah, we patched that in October, Windows giant yawns

Microsoft beefs up Skype for Business as Amazon Chimes in

Corporate comms face-off

Microsoft says Skype outages are over – a few hours too early

Global Skype outages spill over onto a second day

Microsoft finally injects end-to-end chat crypto into Skype – ish...

If you sign up to be a tester

Can't login to Skype? You're not alone. Chat app's been a bit crap for five days now

Something something two-factor authentication – Microsoft

What the @#$%&!? Microsoft bans nudity, swearing in Skype, emails, Office 365 docs

Adults-only Xbox games are OK – but you can't publicly tell Cortana to go screw itself

Google's PHP API client has XSS vulnerability

Patch promised

Make sure your Skype is up to date because FYI there's a nasty hole in it

Nothing to see here, says Microsoft, just more crappy code

Skype for Business has nasty habit of closing down… for business

It's not just you, VoIP app is prone to failures