And I checked the Electron version which is 9-x-y using relatively old Chromium Chrome/.122. If the sandbox is not set to true, by default the App runs without sandbox. But still there is one import webPreference is missing which is sandbox flag.

So far, webPreferences looks good as far as the previous RCE’s on Electron Applications concerned. join( _ dirname, 'mainScreenPreload.js'), When it comes to Javascript hacking, most of the time you can get the source code either it is a Web Application Frontend or JS based Desktop Applications.Ĥ blinkFeatures : 'EnumerateDevices,AudioOutputDevices',Ħ preload : _ path. The one thing I always love to do is source code auditing, it makes things easier unlike BlackBox testing. The interesting thing about ElectronJS Applications are you can extract the JavaScript used to build the application using the below command. Discord uses ElectronJS for their Desktop Application and to be honest I didn’t really know much about ElectronJS at that time but I thought it is just an JavaScript Application and started learning and hacking. Obviously, I decided to pwn the Discord Desktop Application because it was being used for our Prototype Pollution research collabaration. With such a result, I opted to start hacking Desktop Applications.

The program noticed our escalation to RCE and immediately fixed & paid out with a nice bounty. However, the desktop app is not Electron based regardless, I was still able to get an RCE with ptrYudai’s help. The program scope had a desktop application as well, which made me curious If I could exploit this to get RCE on the desktop app.

The XSS report wasn’t getting much attention and was still in triaged state from two months with no response. – by s1r1us, the bug reported on: July 10th 2021 Prologue How Electrovolt Started?ĭuring our prototype pollution research, BlackFan reported an XSS to an BBP.

Discord desktop site