7 ms·
I'm confused about the scope of the RCE. Can it escape the Chromium renderer sandbox? Or is that sandbox disabled? Based on the following: > MS Teams ElectronJ
by mwcampbell 6y ago
I'm confused about the scope of the RCE. Can it escape the Chromium renderer sandbox? Or is that sandbox disabled? Based on the following:
> MS Teams ElectronJS security: remote-require is disabled & filtered, nodeIntegration is false, webview creation is filtered and normally removes insecure params/options. You cannot simply import child_process and execute arbitrary code or create a webview with a custom preload option.
it looks like they did everything right.
I would like this thread to go beyond outrage at how Microsoft handled this, or another excuse to bash Electron. What lessons can developers using Electron take from this? (No, "don't use Electron" doesn't count.)
- oskarsv 6y agothere are different levels of security for ElectronJS, some, like in this case are not enough. I think it will take a long time before we can call ElectronJS secure. there are regular sandbox escapes and that is from what we know publicly
- untog 6y agoThe OP is asking for more detail than “not enough”, though: “Can it escape the Chromium renderer sandbox? Or is that sandbox disabled?”
- oskarsv 6y agoto simplify - no it’s not enabled the real answer is more complicated as it is not necessarily a global setting and depends on what you call a “sandbox”
- mwcampbell 6y agoThanks. I'd pay (moderately) for the more complicated answer. An ebook on Electron security might be a good idea.
- oskarsv 6y agoI'm not an expert on Electron security! But if not addressed to me, there is no need to pay, you can start here: - https://www.electronjs.org/docs/tutorial/security https://www.electronjs.org/docs/tutorial/security - https://github.com/electron/electron/security/advisories https://github.com/electron/electron/security/advisories As you can see there are plenty of considerations and pitfalls to take into account. Best option is to enable contextIsolation for everything. Further, Electron security is closely tied to Chrome security so that is one deep rabbit hole
- pjmlp 6y agoBest Electron security is not using it in first place.
- MaxBarraclough 6y agoRather just keep it in the browser? ;-P
- kevingadd 6y agoThis is safer to a significant degree.
- coldtea 6y agoYeah, let's stick with raw C/C++, that would be much safer... Or maybe let's use some research language made by Wirth, and get access to all 10 of packages and 5 devs worldwide using it :-)
- deleted 6y ago[deleted]
- stagger87 6y agoWhat lessons can we learn from banging our heads on the wall? (No, "don't bang your head on the wall" doesn't count.)
- jacquesm 6y agoAvoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it.
- pjmlp 6y agoStarting by anything running on top of Electron.
- ROARosen 6y agoEspecially if said machines are actually built by Microsoft.
- boogies 6y agoIn which case they may be nice enough to block some of their software for you https://www.techrepublic.com/article/microsoft-blocks-major-windows-10-update-for-1700-flagship-surface-book-2-after-bug-makes-gpu-vanish/ https://www.techrepublic.com/article/microsoft-blocks-major-...
- coldtea 6y agoYeah, because other companies or FOSS have a better track record. E.g. we can drop Exchange for email for a safe alternative like Sendmail.
- jacquesm 6y agoYes, Google has a better track record. You brought open source and - totally unrelated - sendmail into it.
- 6y ago
- dbjorge 6y agoThe article explains the technical details of the render process escape. Contrary to all the current replies to this comment, it does not look to me that this is using a generalized Electron escape; rather, it is using specific main/render IPC calls which Teams has implemented unsafely as the escape mechanism. Perhaps folks are confusing this with an electron sandbox issue because Teams happens to have called the variable containing their IPC APIs "electronSafeIpc".
- coldtea 6y ago>No, "don't use Electron" doesn't count Why would it count? The situation would have more easily occured and be even worse with a C/C++ native app.
- gitweb 6y agoRust advocates remind me of Apple and Firefox fanbois. They are like the snake oil salesmen.
- coldtea 6y agoOr, you know, reasomable people, with their own arguments, you knee-jerkly dismiss... (Not that Rust's safety over C/C++ is an "opinion" or subject to argumentation).
- jcelerier 6y agowould it though - in a C++ app there'd be way less places where people could send you arbitrary code to run over the network ; and if you use any kind of high-level network library you'd be well pressed to have any kind of buffer overflow, as all the buffer handling is done in already-vetted libs, such as Qt, Boost, cpp-rest-sdk, etc
- freeone3000 6y agoIt's in the IPC invocation, so for this app in particular, it'd be in the exact same place.
- jcelerier 6y agoI have a hard time seeing how. It seems to work by having some JS code to create a webview getting executed. In a pure C++ app there would be no place that would even be able to interpret that js, or any other "script language" in that pipeline.
- CyanLite2 6y agoThey could ummm.... build a cross-platform UI framework that rivals Electron without the security and memory bloat issues? I think that's the plan with MAUI.