| 1 | rules: |
| 2 | |
| 3 | - id: cyc-electron-ipc-to-exec |
| 4 | languages: [javascript, typescript] |
| 5 | severity: ERROR |
| 6 | message: > |
| 7 | An ipcMain handler that calls child_process / eval / Function is a renderer->main RCE CANDIDATE: |
| 8 | the renderer controls the IPC args. IMPACT GATE: Family 1. Confirm the arg reaches the sink in |
| 9 | Joern; prove with a callback from the main process. |
| 10 | metadata: |
| 11 | cwe: ["CWE-78: OS Command Injection", "CWE-95: Eval Injection"] |
| 12 | confidence: HIGH |
| 13 | archetype: [electron-desktop] |
| 14 | impact: rce |
| 15 | patterns: |
| 16 | - pattern-either: |
| 17 | - patterns: |
| 18 | - pattern-inside: ipcMain.handle($CH, function (...) {...}) |
| 19 | - pattern-either: |
| 20 | - pattern: $CP.exec(...) |
| 21 | - pattern: $CP.execSync(...) |
| 22 | - pattern: $CP.spawn(...) |
| 23 | - pattern: eval(...) |
| 24 | - pattern: new Function(...) |
| 25 | - patterns: |
| 26 | - pattern-inside: ipcMain.on($CH, function (...) {...}) |
| 27 | - pattern-either: |
| 28 | - pattern: $CP.exec(...) |
| 29 | - pattern: $CP.execSync(...) |
| 30 | - pattern: $CP.spawn(...) |
| 31 | - pattern: eval(...) |
| 32 | - pattern: new Function(...) |
| 33 | - patterns: |
| 34 | - pattern-inside: "ipcMain.handle($CH, (...) => {...})" |
| 35 | - pattern-either: |
| 36 | - pattern: $CP.exec(...) |
| 37 | - pattern: $CP.execSync(...) |
| 38 | - pattern: $CP.spawn(...) |
| 39 | - pattern: eval(...) |
| 40 | - pattern: new Function(...) |
| 41 | - patterns: |
| 42 | - pattern-inside: "ipcMain.on($CH, (...) => {...})" |
| 43 | - pattern-either: |
| 44 | - pattern: $CP.exec(...) |
| 45 | - pattern: $CP.execSync(...) |
| 46 | - pattern: $CP.spawn(...) |
| 47 | - pattern: eval(...) |
| 48 | - pattern: new Function(...) |
| 49 | |
| 50 | - id: cyc-electron-shell-openexternal |
| 51 | languages: [javascript, typescript] |
| 52 | severity: ERROR |
| 53 | message: > |
| 54 | shell.openExternal / shell.openPath with a renderer-influenced argument can launch arbitrary |
| 55 | programs / file: URIs -> RCE. IMPACT GATE: Family 1. Confirm taint in Joern. |
| 56 | metadata: |
| 57 | cwe: ["CWE-749: Exposed Dangerous Method", "CWE-78: OS Command Injection"] |
| 58 | confidence: MEDIUM |
| 59 | archetype: [electron-desktop] |
| 60 | impact: rce |
| 61 | patterns: |
| 62 | - pattern-either: |
| 63 | - pattern: shell.openExternal(...) |
| 64 | - pattern: shell.openPath(...) |
| 65 | - pattern: $S.openExternal(...) |
| 66 | |
| 67 | - id: cyc-electron-unsafe-webprefs |
| 68 | languages: [javascript, typescript] |
| 69 | severity: WARNING |
| 70 | message: > |
| 71 | Unsafe BrowserWindow webPreferences (nodeIntegration:true / contextIsolation:false / |
| 72 | sandbox:false / webSecurity:false) collapse the renderer/main trust boundary, turning any XSS |
| 73 | in loaded content into full Node RCE. IMPACT GATE: enables Family 1. This is a CONFIG candidate, |
| 74 | not a dataflow finding - pair with an XSS/remote-content sink. |
| 75 | metadata: |
| 76 | cwe: ["CWE-1188: Insecure Default Initialization", "CWE-829: Inclusion of Untrusted Functionality"] |
| 77 | confidence: MEDIUM |
| 78 | archetype: [electron-desktop] |
| 79 | impact: rce-enabler |
| 80 | patterns: |
| 81 | - pattern-either: |
| 82 | - pattern: "nodeIntegration: true" |
| 83 | - pattern: "contextIsolation: false" |
| 84 | - pattern: "sandbox: false" |
| 85 | - pattern: "webSecurity: false" |
| 86 | - pattern: "allowRunningInsecureContent: true" |
| 87 | |
| 88 | - id: cyc-electron-executejs |
| 89 | languages: [javascript, typescript] |
| 90 | severity: WARNING |
| 91 | message: > |
| 92 | webContents.executeJavaScript / loadURL with a tainted string injects code/navigation into a |
| 93 | privileged context. IMPACT GATE: Family 1 if combined with node-enabled context. Confirm taint |
| 94 | in Joern. |
| 95 | metadata: |
| 96 | cwe: ["CWE-95: Eval Injection"] |
| 97 | confidence: MEDIUM |
| 98 | archetype: [electron-desktop] |
| 99 | impact: rce |
| 100 | patterns: |
| 101 | - pattern-either: |
| 102 | - pattern: $WC.executeJavaScript($X, ...) |
| 103 | - pattern: $WC.loadURL($X, ...) |
| 104 | - metavariable-pattern: |
| 105 | metavariable: $X |
| 106 | patterns: |
| 107 | - pattern-not: "\"...\"" |
| 108 | - pattern-not: "'...'" |
| 109 | - pattern-not: "`...`" |