ASAR Integrity Bypass in Electron Framework for Windows Applications

CVE-2024-46992

What is CVE-2024-46992?

The Electron framework is vulnerable to an ASAR integrity bypass specifically on Windows platforms. This vulnerability affects versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, impacting applications that have enabled the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses. The vulnerability arises when an application is launched from a writable filesystem, allowing potential exploitation by an attacker with write access to the .app bundle. This issue does not impact macOS applications using the same fuses. The vulnerability has been addressed in the updated versions 30.0.5 and 31.0.0-beta.1, which provide the necessary patch.

References