Vulnerability-Lookup

CVE-2024-46992 (GCVE-0-2024-46992)

Vulnerability from cvelistv5 – Published: 2025-07-01 01:43 – Updated: 2025-07-01 14:33

Title

Electron ASAR Integrity bypass by just modifying the content

Summary

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

GitHub_M

References

URL

Tags

	https://github.com/electron/electron/security/adv…	x_refsource_CONFIRM
	https://www.electronjs.org/docs/latest/tutorial/fuses	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	electron	electron	Affected: >= 30.0.0-alpha.1, < 30.0.5 Affected: >= 31.0.0-alpha.1, < 31.0.0-beta.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46992",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-01T14:32:53.122906Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-01T14:33:20.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 30.0.0-alpha.1, \u003c 30.0.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 31.0.0-alpha.1, \u003c 31.0.0-beta.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354: Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-01T01:43:13.767Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc"
        },
        {
          "name": "https://www.electronjs.org/docs/latest/tutorial/fuses",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
        }
      ],
      "source": {
        "advisory": "GHSA-xw5q-g62x-2qjc",
        "discovery": "UNKNOWN"
      },
      "title": "Electron ASAR Integrity bypass by just modifying the content"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-46992",
    "datePublished": "2025-07-01T01:43:13.767Z",
    "dateReserved": "2024-09-16T16:10:09.019Z",
    "dateUpdated": "2025-07-01T14:33:20.698Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46992\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-01T14:32:53.122906Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-01T14:33:15.967Z\"}}], \"cna\": {\"title\": \"Electron ASAR Integrity bypass by just modifying the content\", \"source\": {\"advisory\": \"GHSA-xw5q-g62x-2qjc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"electron\", \"product\": \"electron\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 30.0.0-alpha.1, \u003c 30.0.5\"}, {\"status\": \"affected\", \"version\": \"\u003e= 31.0.0-alpha.1, \u003c 31.0.0-beta.1\"}]}], \"references\": [{\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc\", \"name\": \"https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://www.electronjs.org/docs/latest/tutorial/fuses\", \"name\": \"https://www.electronjs.org/docs/latest/tutorial/fuses\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-354\", \"description\": \"CWE-354: Improper Validation of Integrity Check Value\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-07-01T01:43:13.767Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46992\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-01T14:33:20.698Z\", \"dateReserved\": \"2024-09-16T16:10:09.019Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-07-01T01:43:13.767Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-XW5Q-G62X-2QJC

Vulnerability from github – Published: 2025-06-30 17:54 – Updated: 2025-07-01 13:13

Summary

electron ASAR Integrity bypass by just modifying the content

Details

electron's ASAR Integrity can be bypass by modifying the content.

Impact

This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are unimpacted.

Specifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against.

Workarounds

There are no app side workarounds, you must update to a patched version of Electron.

Fixed Versions

30.0.5
31.0.0-beta.1

For more information

If you have any questions or comments about this advisory, email us at security@electronjs.org

Severity ?

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "30.0.0-alpha.1"
            },
            {
              "fixed": "30.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "31.0.0-alpha.1"
            },
            {
              "fixed": "31.0.0-beta.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-46992"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-354"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-30T17:54:11Z",
    "nvd_published_at": "2025-07-01T02:15:20Z",
    "severity": "HIGH"
  },
  "details": "electron\u0027s ASAR Integrity can be bypass by modifying the content.\n\n### Impact\nThis only impacts apps that have the `embeddedAsarIntegrityValidation` and `onlyLoadAppFromAsar` [fuses](https://www.electronjs.org/docs/latest/tutorial/fuses) enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are unimpacted.\n\nSpecifically this issue can only be exploited if your app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against.\n\n### Workarounds\nThere are no app side workarounds, you must update to a patched version of Electron.\n\n### Fixed Versions\n* `30.0.5`\n* `31.0.0-beta.1`\n\n### For more information\nIf you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-xw5q-g62x-2qjc",
  "modified": "2025-07-01T13:13:18Z",
  "published": "2025-06-30T17:54:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46992"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron/electron"
    },
    {
      "type": "WEB",
      "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "electron ASAR Integrity bypass by just modifying the content"
}

FKIE_CVE-2024-46992

Vulnerability from fkie_nvd - Published: 2025-07-01 02:15 - Updated: 2025-07-03 15:14

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc
	security-advisories@github.com	https://www.electronjs.org/docs/latest/tutorial/fuses

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macOS are not impacted. Specifically this issue can only be exploited if the app is launched from a filesystem the attacker has write access too. i.e. the ability to edit files inside the .app bundle on macOS which these fuses are supposed to protect against. This issue has been patched in versions 30.0.5 and 31.0.0-beta.1. There are no workarounds for this issue."
    },
    {
      "lang": "es",
      "value": "Electron es un framework de c\u00f3digo abierto para escribir aplicaciones de escritorio multiplataforma con JavaScript, HTML y CSS. Desde la versi\u00f3n 30.0.0-alpha.1 hasta la anterior a la 30.0.5 y desde la 31.0.0-alpha.1 hasta la anterior a la 31.0.0-beta.1, Electron es vulnerable a una omisi\u00f3n de integridad ASAR. Esto solo afecta a las apps que tienen habilitados los fusibles embeddedAsarIntegrityValidation y onlyLoadAppFromAsar. Las apps sin estos fusibles habilitados no se ven afectadas. Este problema es espec\u00edfico de Windows; las apps que usan estos fusibles en macOS no se ven afectadas. En concreto, este problema solo se puede explotar si la app se inicia desde un sistema de archivos al que el atacante tiene acceso de escritura, es decir, la capacidad de editar archivos dentro del paquete .app en macOS, contra el cual se supone que estos fusibles protegen. Este problema se ha corregido en las versiones 30.0.5 y 31.0.0-beta.1. No existen soluciones alternativas."
    }
  ],
  "id": "CVE-2024-46992",
  "lastModified": "2025-07-03T15:14:12.767",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-01T02:15:20.977",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-xw5q-g62x-2qjc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.electronjs.org/docs/latest/tutorial/fuses"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-46992 (GCVE-0-2024-46992)

GHSA-XW5Q-G62X-2QJC

Impact

Workarounds

Fixed Versions

For more information

FKIE_CVE-2024-46992

Tags

Sightings

Nomenclature