Summary
The noname Electron desktop build includes an unauthenticated local file server that accepts cross-origin requests because it uses wildcard CORS. A malicious website may be able to read, overwrite, or delete installation files; overwriting renderer scripts could lead to JavaScript execution with Node.js access as the local user.
The noname Electron desktop build includes an unauthenticated local file server that accepts cross-origin requests because it uses wildcard CORS. A malicious website may be able to read, overwrite, or delete installation files; overwriting renderer scripts could lead to JavaScript execution with Node.js access as the local user.
Affected context
The issue is described in noname Electron desktop builds from v1.11.2 through v1.11.6.1. It occurs when the local file server is reachable on localhost port 8089 and exposes file operations without authentication while permitting cross-origin requests. The risk depends on the server being available and a browser being able to reach it from a malicious website.
The issue is described in noname Electron desktop builds from v1.11.2 through v1.11.6.1. It occurs when the local file server is reachable on localhost port 8089 and exposes file operations without authentication while permitting cross-origin requests. The risk depends on the server being available and a browser being able to reach it from a malicious website.
Exploit preconditions
- Attack surface: The local file server listening on localhost port 8089
- Required access: No authentication is required by the described server; the attacker must be able to cause a victim to visit a malicious website
- Trigger point: Cross-origin requests to file-operation endpoints such as
/writeFile - Why exploitation is possible: Wildcard CORS permits cross-origin interaction, and the server performs file operations without verifying the requester
- Attack surface: The local file server listening on localhost port 8089
- Required access: No authentication is required by the described server; the attacker must be able to cause a victim to visit a malicious website
- Trigger point: Cross-origin requests to file-operation endpoints such as
/writeFile - Why exploitation is possible: Wildcard CORS permits cross-origin interaction, and the server performs file operations without verifying the requester
Why this happens
The server exposes sensitive file operations without an authentication check. This maps to CWE-306: Missing Authentication for Critical Function, because the application does not establish that a requester is authorized before performing those operations. Wildcard CORS further allows websites from arbitrary origins to make cross-origin requests to the local service.
The server exposes sensitive file operations without an authentication check. This maps to CWE-306: Missing Authentication for Critical Function, because the application does not establish that a requester is authorized before performing those operations. Wildcard CORS further allows websites from arbitrary origins to make cross-origin requests to the local service.
Potential impact
- A malicious website could read or tamper with accessible installation files.
- An attacker could overwrite renderer scripts and potentially execute JavaScript with Node.js access as the local user.
- Files could be deleted, disrupting the desktop application.
- Code execution in the application context could expose local data or enable further actions permitted to the user.
- A malicious website could read or tamper with accessible installation files.
- An attacker could overwrite renderer scripts and potentially execute JavaScript with Node.js access as the local user.
- Files could be deleted, disrupting the desktop application.
- Code execution in the application context could expose local data or enable further actions permitted to the user.
General mitigation guidance
Defensive patterns include requiring strong authorization for sensitive local service operations and limiting the service to trusted callers. Restrict or avoid cross-origin access rather than using wildcard CORS, and expose only the minimum necessary file operations.
Treat requests and file paths as untrusted: validate them against a strict allowlist and constrain file access to intended locations. Where practical, avoid serving sensitive file operations over a browser-accessible local interface. Run the application with least privilege so a compromise has fewer available resources.
Defensive patterns include requiring strong authorization for sensitive local service operations and limiting the service to trusted callers. Restrict or avoid cross-origin access rather than using wildcard CORS, and expose only the minimum necessary file operations.
Treat requests and file paths as untrusted: validate them against a strict allowlist and constrain file access to intended locations. Where practical, avoid serving sensitive file operations over a browser-accessible local interface. Run the application with least privilege so a compromise has fewer available resources.
How teams detect issues like this
- Use static analysis and code review to identify local HTTP servers that expose file read, write, or delete operations without authentication.
- Review CORS configuration for wildcard origins on services bound to localhost.
- Check that file operations enforce authorization, constrain paths, and reject unexpected request origins.
- Apply security policies or automated review checks to flag unauthenticated local services and broad CORS settings.
- Use static analysis and code review to identify local HTTP servers that expose file read, write, or delete operations without authentication.
- Review CORS configuration for wildcard origins on services bound to localhost.
- Check that file operations enforce authorization, constrain paths, and reject unexpected request origins.
- Apply security policies or automated review checks to flag unauthenticated local services and broad CORS settings.
