Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29257

CVE-2022-29257: AutoUpdater module fails to validate certain nested components of the bundle

6.6

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29257
GHSA ID
GHSA-77xc-hjv8-ww97
EPSS Score
0.60761%
CWE
CWE-20
Published
6/16/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
electronnpm< 15.5.015.5.0
electronnpm>= 16.0.0, < 16.2.016.2.0
electronnpm>= 17.0.0, < 17.2.017.2.0
electronnpm>= 18.0.0-beta.1, <= 18.0.0-beta.518.0.0-beta.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper code signing validation of nested components in macOS update bundles. Electron's AutoUpdater relies on Squirrel.Mac's SUCodeSigningVerifier, which prior to the patch did not use the --deep flag or equivalent recursive validation when checking code signatures. This allowed attackers to embed malicious code in nested components that would pass top-level validation. The CWE-20 (Improper Input Validation) classification and macOS-specific advisory context align with this root cause. The patched versions likely introduced recursive validation via codesign --deep or similar mechanisms.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility *llows *tt**k*rs w*o **v* *ontrol ov*r * *iv*n *pps up**t* s*rv*r / up**t* stor*** to s*rv* m*li*iously *r**t** up**t* p**k***s t**t p*ss t** *o** si*nin* v*li**tion ****k *ut *ont*in m*li*ious *o** in som* *ompon*nts.

Reasoning

T** vuln*r**ility st*ms *rom improp*r *o** si*nin* v*li**tion o* n*st** *ompon*nts in m**OS up**t* *un*l*s. *l**tron's *utoUp**t*r r*li*s on Squirr*l.M**'s SU*o**Si*nin*V*ri*i*r, w*i** prior to t** p*t** *i* not us* t** `--***p` *l** or *quiv*l*nt r*