[electron-updater] Update is installed even though signature verification fails

[rajivshah3]

• Version:
  electron-builder: 22.3.5
  electron-updater: 4.2.4

• Target: Windows (NSIS)

dead150 is only a partial fix for the signature verification bypass issue recently disclosed by Doyensec. While it is no longer possible to trigger the parse errors with single or double quotes as of dead150, there are other ways to cause them.

From the report:

we believe that other attack payloads for the same vulnerable code path still [exist] in Electron-Builder.

In my opinion, the root cause of the vulnerability lies in the fact that even though signature verification is failing, the update is still installed:

electron-builder/packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts

Lines 37 to 38 in caebf37

	logger.warn(`Cannot execute Get-AuthenticodeSignature: ${error}. Ignoring signature validation due to unknown error.`)
	resolve(null)

electron-builder/packages/electron-updater/src/NsisUpdater.ts

Line 42 in caebf37

if (signatureVerificationStatus != null) {

So, even though an error is encountered, null is resolved and the update is installed anyway. I opened this issue because I was hoping to start a discussion on the following:

• Is there a reason why we would want the update to be installed despite the fact that signature verification failed (i.e. is there a valid use case for the current behavior)?
• We would prefer that any errors in signature verification cause the update process to abort. Would a PR for the ability to opt-in to stricter signature verification (e.g. strictSignatureVerification: true in the electron-builder config) be accepted?

[stale]

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.

[rajivshah3]

This is still relevant

[huntr-helper]

‎‍🛠️ A fix has been provided for this issue. Please reference: 418sec#1

🔥 This fix has been provided through the https://huntr.dev/ bug bounty platform.