search

ExpressLRS / ExpressLRS-Configurator

Cross platform configuration & build tool for the ExpressLRS radio link
GNU General Public License v3.0
595 stars 130 forks source link

Sanitizing URLs sent to `shell.openExternal()`, in-app navigation, and Electron.js Version #570

Closed masood closed 10 months ago

masood commented 1 year ago

Thank you for designing the ExpressLRS-Configurator Desktop Application and making it open source and available.

Expected Behavior

The app could benefit from:

  1. Preventing file:// URLs from being passed to shell.openExternal().
  2. Adding an event listener to the will-navigate event.
  3. Upgrading the Electron.js Version.

Current Behavior

The application adds an event listener that prevents opening new windows. However, it does not sanitize URLs before passing them to the underlying system. Additionally, it does not use an event listener to prevent in-app navigation within the same window. Moreover, the application can benefit from an update to the underlying Electron.js version.

Steps to Reproduce

  1. Open the ExpressLRS-Configurator Desktop Application from the command-line. Add a command-line switch --remote-debugging-port=8315 while running the application.
  2. Open a web browser on the same device and visit localhost:8315. The application can be interacted with via the DevTools protocol.
  3. [In-app Navigation] Within the console, enter window.location=”https://attacker.com/”. The application window navigates to the third-party site.
  4. [Run Sensitive Executable Files] Alternatively, within the console, enter window.open(“file:///Applications/Emacs.app/Contents/MacOS/Emacs”). An alternative would be to check window.open(“file:///Applications/Safari.app/Contents/MacOS/Safari”) which opens the Safari browser. The application passes the link to the underlying system which opens the executable file if one exists at the path.
  5. [Electron.js Version] Finally, the current version of Excel Parser depends on Electron v20.3.3 which is vulnerable to numerous CVEs. [Example] The app can benefit from an update to the framework version that fixes numerous security issues. [Link]

Environments Affected

-- Mir Masood Ali, PhD student, University of Illinois at Chicago Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago Chris Kanich, Associate Professor, University of Illinois at Chicago Jason Polakis, Associate Professor, University of Illinois at Chicago