ベルリンã§é–‹å‚¬ã•ã‚ŒãŸCure53ã®ã‚¤ãƒ™ãƒ³ãƒˆã€CureConã®è³‡æ–™ã§ã™ã€‚
Electron: Context Isolationã®æ¬ 如を利用ã—ãŸä»»æ„コード実行 / Electron: Abusing the lack of context isolation - CureCon(ja)
ベルリンã§é–‹å‚¬ã•ã‚ŒãŸCure53ã®ã‚¤ãƒ™ãƒ³ãƒˆã€CureConã®è³‡æ–™ã§ã™ã€‚
Exploiting Electron RCE in Exodus wallet | HackerNoon
While browsing Twitter I’ve noticed ElectronJS remote code execution vulnerability in protocol handler. That sounds severe. As stated in official description, for application to be vulnerable is enough to register itself as default handler for some protocol. I had one application based on Electron installed on my laptop that I was looking into some time ago — Exodus cryptocurrencies wallet. I knew
Protocol Handler Vulnerability Fix | Electron
A remote code execution vulnerability has been discovered affecting Electron apps that use custom protocol handlers. This vulnerability has been assigned the CVE identifier CVE-2018-1000006. Affected Platforms​ Electron apps designed to run on Windows that register themselves as the default handler for a protocol, like myapp://, are vulnerable. Such apps can be affected regardless of how the proto
DeNA Engineering - DeNAエンジニアã®ãƒãƒ¼ã‚¿ãƒ«ã‚µã‚¤ãƒˆ
技術を活ã‹ã—ã€æ–°ã—ã„ä¾¡å€¤ã‚’å‰µé€ ã™ã‚‹ DeNAã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¯ã€æƒ³åƒã‚’超ãˆã‚‹Delightを届ã‘ã‚‹ãŸã‚ã«ä½•ãŒã§ãã‚‹ã‹ã‚’考ãˆã€æŠ€è¡“力ã¨ç™ºæƒ³åŠ›ã§æ–°ã—ã„価値を生ã¿å‡ºã—ã¦ã„ã¾ã™ã€‚ 多様ãªå°‚門性をæŒã£ãŸã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒåˆ‡ç£‹ç¢ç£¨ã—ã€äº’ã„ã«åˆºæ¿€ã—åˆãˆã‚‹ç’°å¢ƒã‚„制度ãŒã•ã‚‰ãªã‚‹æˆé•·ã¸ã¨ã¤ãªã’ã¾ã™ã€‚
マルãƒãƒ—ラットフォームã§å‹•ã「Electronã€ã¯æœ¬å½“ã«ä½¿ãˆã‚‹æŠ€è¡“ãªã®ã‹ï¼Ÿï½œCodeIQ MAGAZINE
2018å¹´4月25日をもã¡ã¾ã—ã¦ã€ 『CodeIQã€ã®ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è…•è©¦ã—サービスã€å¹´åŽç¢ºç´„スカウトサービスã¯ã€ ITエンジニアã®ãŸã‚ã®å¹´åŽç¢ºç´„スカウトサービス『moffers by CodeIQã€https://moffers.jp/ ã¸ä¸€æœ¬åŒ–ã„ãŸã—ã¾ã—ãŸã€‚ ã“ã‚Œã¾ã§å¤šãã®ITエンジニアã®æ–¹ã«ã€ŽCodeIQã€ã‚’ã”利用ã„ãŸã ãã¾ã—ã¦ã€ 改ã‚ã¦å¿ƒã‚ˆã‚Šæ·±ã御礼申ã—上ã’ã¾ã™ã€‚ ã¾ãŸã€ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®ãŸã‚ã®Webマガジン「CodeIQ MAGAZINEã€ã¯ã€ リクナビNEXTジャーナル( https://next.rikunabi.com/journal/ )ã«ä¸€éƒ¨ã®è¨˜äº‹ã®ç§»è¡Œã‚’予定ã—ã¦ãŠã‚Šã¾ã™ã€‚ 今後ã¯ã€Žmoffers by CodeIQã€ã«ã¦ã€ ITエンジニアã®çš†æ§˜ã®ã‚ˆã‚Šè‰¯ã„転è·ã‚’サãƒãƒ¼ãƒˆã™ã‚‹ãŸã‚ã«ã€ã‚ˆã‚Šä¸€å±¤åŠªã‚ã¦ã¾ã„ã‚Šã¾ã™ã®ã§ã€ 引ã続ãã”愛顧ã®ã»ã©ä½•å’よã‚ã—ããŠé¡˜ã„申ã—上ã’ã¾ã™ã€‚ ã¾ãŸã€Cod
Electronã§ã‚¢ãƒ—リを書ãå ´åˆã¯ã€æ°—åˆã„ã¨æ ¹æ€§ã§XSSを発生ã•ã›ãªã„よã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„。 - 葉ã£ã±æ—¥è¨˜
ãã®ã†ã¡ã‚‚ã†å°‘ã—ãã¡ã‚“ã¨æ›¸ãã¾ã™ãŒã€ã¨ã‚Šã‚ãˆãšæ™‚é–“ãŒãªã„ã®ã§çµè«–ã ã‘書ãã¨ã€ã‚¿ã‚¤ãƒˆãƒ«ãŒå…¨ã¦ã§Electronã§ã‚¢ãƒ—リを書ãå ´åˆã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSを発生ã•ã›ãªã„よã†ã«ã—ãªã‘ã‚Œã°ãªã‚‰ãªã„。 ã“ã‚Œã¾ã§Webアプリケーション上ã§XSSãŒå˜åœ¨ã—ãŸã¨ã—ã¦ã‚‚ã€å½±éŸ¿ç¯„囲ã¯ãã®Webアプリケーションã®ä¸ã«ç•™ã¾ã‚‹ã®ã§ã€Webアプリケーションã®æä¾›å´ãŒãれを許容ã™ã‚‹ã®ã§ã‚ã‚Œã°XSSã®å˜åœ¨ã«ç›®ã‚’ã¤ã‚€ã‚‹ã“ã¨ã‚‚ã§ããŸã€‚ã—ã‹ã—ã€Electronアプリã§DOM-based XSSãŒä¸€ã‹æ‰€ã§ã‚‚発生ã™ã‚‹ã¨ã€(ãŠãらã)確実ã«ä»»æ„コード実行ã¸ã¨ã¤ãªãŒã‚Šã€åˆ©ç”¨è€…ã®PCã®(ãã®ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ã®)全機能ãŒæ”»æ’ƒè€…ã«ã‚ˆã£ã¦åˆ©ç”¨ã§ãる。 ãã®ãŸã‚ã€Electronã§ã‚¢ãƒ—リケーションを作æˆã™ã‚‹é–‹ç™ºè€…ã¯æ°—åˆã„ã¨æ ¹æ€§ã§XSSを完全ã«ã¤ã¶ã•ãªã‘ã‚Œã°ãªã‚‰ãªã„。 nodeIntegration:falseã‚„Content-Security-Pol
Electronã®webviewè¦ç´ ã§ã¯allowpopups属性をã¤ã‘ã¦ã¯ã„ã‘ãªã„ - 葉ã£ã±æ—¥è¨˜
Electronを使ã£ã¦ãƒ–ラウザã®ã‚ˆã†ãªã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’ä½œã‚‹å ´åˆã«ã¯ webviewã‚¿ã‚°ãŒä½¿ç”¨ã•ã‚Œã‚‹ã€‚例ãˆã°ã€ã‚¢ãƒ—リケーション内ã«example.jpã®ã‚µã‚¤ãƒˆã‚’表示ã™ã‚‹ã«ã¯ä»¥ä¸‹ã®ã‚ˆã†ã«HTMLã«è¨˜è¿°ã™ã‚‹ã€‚ <webview src="http://example.jp/"></webview> ã“ã“ã§ã€webviewã‚¿ã‚°ã«allowpopups属性を付与ã™ã‚‹ã¨ã€example.jpサイト内ã®ã‚³ãƒ¼ãƒ‰ã‹ã‚‰window.openç‰ã‚’使ã£ã¦æ–°ãŸã«ã‚¦ã‚£ãƒ³ãƒ‰ã‚¦ã‚’é–‹ãã“ã¨ãŒã§ãるよã†ã«ãªã‚‹ã€‚ã“ã®ã¨ãã€example.jpã«æ‚ªæ„ãŒã‚り以下ã®ã‚ˆã†ãªã‚³ãƒ¼ãƒ‰ãŒå«ã¾ã‚Œã¦ã„ã‚‹ã¨ã™ã‚‹ã€‚ if( typeof require === "undefined" ) window.open( 'http://example.jp/', '', 'nodeIntegration=1'); else require( "chi
1
ランã‚ング
ランã‚ング
ãŠçŸ¥ã‚‰ã›
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Sheepl : Automating People for Red and Blue Tradecraft
https://utf-8.jp/public/2016/0328/shibuyaxss.pdf
{{#tags}}- {{label}}
{{/tags}}