Remote zero-click JavaScript code execution on Signal desktop

https://twitter.com/ortegaalfredo/status/995017143002509313

by uptown • 8 years ago

45 20 8 years ago

twitter.com

0x0• 8 years ago

Ah, yes, Electron, where a simple XSS can quickly turn into full account compromise and RCE? :O

https://blog.doyensec.com/2017/08/03/electron-framework-secu...

krapp2• 8 years ago

Alas, if only there were a way to write native applications in some language other than javascript...

ferricmuskox• 8 years ago

Why would you want to do that? JavaScript is memory-safe.

gitgud• 8 years ago

Other languages? Doesn't JavaScript solve all use cases in every possible context? ...

stephengillie• 8 years ago

Serious questions:

1. Why don't browsers execute (interpret?) languages other than JavaScript?

2. What would be involved in having a browser execute (interpret?) other languages, such as Perl or Python?

f2n3• 8 years ago

It'll be interesting to see how this works, given that the Signal Desktop client's main page (background.html) includes a CSP that restricts it from running inline or external scripts. It can only run JS that's already in the Signal Desktop package (in theory).

The fact that this isn't being described as an issue with CSPs or electron makes me wonder how it could possibly work.

aortega• 8 years ago

You are correct, there's also a flaw on CSP not limiting all the ways you can download a resource. And at this time, it's still not fixed. We'll publish an advisory soon.

aegarbutt3• 8 years ago

In Electron, all file:/// URIs share an origin. Using `script-src: 'self'` isn't much of a boundary.

f2n3• 8 years ago

So let's say I'm able to run HTML in Signal Desktop. How do I include an arbitrary script without getting the user to download the script first?

jsnar2• 8 years ago

Electron is unsafe because it's based on outdated versions of Chromium: https://github.com/signalapp/Signal-Desktop/issues/1635

f2n3• 8 years ago

You've linked that thread a couple of times here, never really elaborating on the nature of your concerns, nor do you elaborate on the specific nature of your concerns in the ticket. Have you considered elaborating on the nature of your concerns? Is there a specific vulnerability in chromium you feel could be exploited here?

jsnar2• 8 years ago

Signal desktop app is based on the insecure Electron runtime. See my report here: https://github.com/signalapp/Signal-Desktop/issues/1635

Boulth• 8 years ago

I read the (now locked) thread, the way they handled the report leaves much to be desired.

ge0rg• 8 years ago

It's time to admit that we can't fix web security anymore, and that we should just start anew. XSS, SQLi, cross origin flaws, etc. There are just too many vectors for a human developer to make a correct implementation.

craftyguy• 8 years ago

It's time to admit that we can't fix web security anymore

It seems like this was fixed in a newer version of chromium.. a version that electron is not based on. This particular problem exists purely because they used a framework that depends on a ridiculously complicated backend, one that the framework has chosen not to follow closely (despite the backend addressing security issues relatively timely)

Remote zero-click JavaScript code execution on Signal desktop

Related Stories