CVE-2023-44402:
ASAR Integrity bypass via filetype confusion in electron
6.1
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.31041%
CWE
Published
12/1/2023
Updated
9/18/2024
KEV Status
No
Technology
JavaScript
JavaScriptTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| electron | npm | < 22.3.24 | 22.3.24 |
| electron | npm | >= 24.0.0-alpha.1, < 24.8.3 | 24.8.3 |
| electron | npm | >= 25.0.0-alpha.1, < 25.8.1 | 25.8.1 |
| electron | npm | >= 26.0.0-alpha.1, < 26.2.1 | 26.2.1 |
| electron | npm | >= 27.0.0-alpha.1, < 27.0.0-alpha.7 | 27.0.0-alpha.7 |
| electron | npm | >= 23.0.0-alpha.1, <= 23.3.13 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper validation of ASAR file integrity. The GitHub PR #39788 fix explicitly addresses this by ensuring loaded files are actual ASAR archives, not just files with .asar extensions. The ElectronMain function in electron_main.cc is the entry point for app initialization and ASAR handling. The vulnerability occurred because this function (or its dependencies) checked the file path extension but not the file's actual content structure. The fix adds validation of the ASAR magic bytes, indicating the original code lacked this critical check. This matches the CWE-345 (Insufficient Verification of Data Authenticity) classification in the advisory.