eDEX-UI Remote Code Injection Disclosure
Published Sun May 19 2019
On April 30th, 2019, a vulnerability was found in the source code of eDEX-UI.
An incorrectly escaped API response in the
netstat module, which pings a remote server to get geoip information about the current network, could lead to remote code injection in the renderer process (which is Node-enabled).
A fix for this vulnerability was pushed to
master as soon as it was discovered, but a new version wasn't released immediately. Using this exploit required that the attacker could spoof a victim's DNS records and certificate storage to point
ipinfo.now.sh to a fake API with a recognized SSL certificate. This was deemed hard enough to not necessitate an immediate release.
eDEX-UI v2.2.2, released today, ships with a fix against this vulnerability, and the geoip API has been switched temporarily to another external, free service.
Starting Monday, May 20th, the
ipinfo.now.sh service will cause older, vulnerable versions of eDEX to display a warning message prompting users to update to
v2.2.2 or above, by exploiting the vulnerability.
Warning message that will be broadcasted on vulnerable versions.
As an open-source maintainer, ensuring the safety of the software I distribute is my number-one priority. This vulnerability was found thanks to the continuous integration services that are continuously scanning the code I push to GitHub.
If you have any questions or concerns, you can reach me by email at
gabriel (at) saillard.dev.