{"id":"CVE-2022-36077","published":"2022-11-08T00:00:00Z","modified":"2025-04-23T16:40:13Z","title":"Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect","vendor":"electron","product":"electron","tier":"tail","description":{"text":"The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. The contents of the file is not available to the renderer following the redirect, but if the redirect target is a SMB URL such as `file://some.website.com/`, then in some cases, Windows will connect to that server and attempt NTLM authentication, which can include sending hashed credentials.This issue has been patched in versions: 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7. Users are recommended to upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by preventing redirects to file:// URLs in the `WebContents.on('will-redirect')` event, for all WebContents as a workaround.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0062,"percentile":0.49539,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-p2jh-44qj-pf2v","tags":[]}],"priority":{"score":14.9,"factors":[{"name":"EPSS percentile","points":9.91},{"name":"CVSS severity","points":5.04}]},"vendorSlug":"electron","affectedVersions":[{"vendor":"electron","product":"electron","versions":[">= v21.0.0-nightly.20220526, < 21.0.0-beta.1",">= 20.0.0-beta.1, < 20.0.1",">= 19.0.0-beta.1, < 19.0.11","< 18.3.7"]}],"affected":[{"ecosystem":"npm","package":"electron","vulnerableRanges":["<18.3.7",">=20.0.0-beta.1, <20.0.1",">=19.0.0-beta.1, <19.0.11"],"patched":["18.3.7","20.0.1","19.0.11"],"from":["GHSA-p2jh-44qj-pf2v"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7391","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-29247","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false},{"cve":"CVE-2022-29257","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false,"link":{"from":"CVE-2022-29257","to":"CVE-2022-36077","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"18.0.0-beta.6","toFixed":"18.3.7","daysApart":148}]}},{"cve":"CVE-2022-4135","published":"2022-11-25","fixed":"19.1.8","kev":true,"link":{"from":"CVE-2022-36077","to":"CVE-2022-4135","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"19.0.11","toFixed":"19.1.8","daysApart":17}]}},{"cve":"CVE-2022-36077","published":"2022-11-08","fixed":"20.0.1","kev":false},{"cve":"CVE-2023-23623","published":"2023-09-06","fixed":"23.0.0-alpha.2","kev":false},{"cve":"CVE-2023-29198","published":"2023-09-06","fixed":"25.0.0-alpha.2","kev":false},{"cve":"CVE-2023-39956","published":"2023-09-06","fixed":"26.0.0-beta.13","kev":false}],"package":"npm:electron"}}