Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

CVE-2024-39698

What is CVE-2024-39698?

The electron-updater component, utilized for automatically updating Electron applications on Windows, has a vulnerability that allows attackers to exploit the signature validation routine. The flaw exists in how the system integrates with 'cmd.exe', which can inadvertently expand environment variables in command-line inputs. This design mistake enables an attacker to manipulate the verifySignature() function. As a result, a crafted malicious update can be executed, potentially leading to the installation of software with invalid signatures. Attack vectors could include compromised update manifests stemming from server breaches, Man-in-the-Middle attacks, or Cross-Site Scripting that redirects applications to illegitimate updater servers. Remediation is available starting with version 6.3.0-alpha.6.

References