ASAR Integrity bypass via filetype confusion in electron

Vulnerability

Description

CVE-2023-44402 affects Electron applications that have both the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. These fuses are designed to ensure that the application only loads code from a valid, signed ASAR archive, preventing tampering with the app's contents on macOS. However, a flaw in the validation logic allows an attacker to bypass these protections if they have write access to the filesystem containing the .app bundle [1][2].

Exploitation

The exploit requires the attacker to be able to modify files inside the .app bundle, for instance, by having write permissions to the directory where the app is installed or by tricking the user into running the app from a location the attacker controls. When the app launches from a compromised filesystem, the fuses fail to properly enforce that the loaded archive is a genuine ASAR file, allowing a malicious replacement to be used instead [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the Electron application. Since Electron apps often have access to system resources, this could lead to data theft, privilege escalation, or further compromise of the user's system.

Mitigation

Users must update their Electron framework to a patched version that addresses this validation bypass. The fix was implemented in pull request #39788 and backported to multiple stable branches [4]. There are no workarounds available for affected applications; updating is the only remedy [1][2].