Abstract

Electron framework is used to build cross-platform software. It is a framework for creating native applications with web technologies like JavaScript, HTML, and CSS.

Due to the nature of this framework, it is exposed to common web vulnerabilities such as XSS, in order to prevent the use of this bugs to take advantage of the nodeJS environment, the electron documentation offers a guide to best practices and security flags. Originally these measures were optional, and it was developer’s choice to implement them, since this approach was prone to errors, over time the security measures were transferred to default configuration.

I have identified that the traditional way of exploiting electron-based applications isn’t viable due to default configuration being hardened, lowering the chance for common misconfigurations to be found and exploited. Therefore, through targeting application logic and the electron framework itself I found different attack vectors that allowed me to gain arbitrary code execution despite the security flags and best practices being applied. This presentation will demonstrate how to find misconfigurations both in the Electron framework itself, which can be exploited in different applications, as in the logic of a particular flow of each application, for example by looking for event listeners that could be leveraged to expand the attack surface in order to bypass restrictions on a process with safe security flags.