electron-updater signature bypass

Electron apps usually self-update with the electron-updater library. The flow: the app downloads a latest.yml file specifying the URL of the new installer and its SHA-512 hash; it downloads the binary, checks the hash and, on Windows, validates the Authenticode signature before running it. If the signature is invalid, in theory it shouldn't install.

The flaw (documented by Doyensec, 2020) is in how it validates the signature. electron-updater builds a PowerShell command by concatenating the file name without escaping:

Get-AuthenticodeSignature 'FILE_NAME'

If the attacker names their binary with a single quote (e.g. r'everse.exe), the command becomes:

Get-AuthenticodeSignature 'r'everse.exe'

Broken syntax → PowerShell returns an error, not a signature result. And here's the problem: electron-updater treats that error as "couldn't verify" and, due to a fail-open behaviour, instead of aborting it accepts the binary and runs it. Result: an unsigned installer (with a reverse shell) runs as if it were a legitimate update → RCE.

Requirements to exploit it. You must be able to deliver the latest.yml and the binary to the update channel: an update server under your control, or (as in Atom) a writable SMB share the update process picks them up from. Steps: generate the binary with a ' in the name (msfvenom), compute its sha512, build the latest.yml with the url pointing to your host and the hash, and force/wait for the update.

How to detect it. The signature is a downloaded installer whose name contains a single quote (') and a latest.yml fetched from a non-official URL/share, both anomalous. On the host, Get-AuthenticodeSignature returning a syntax error (loggable via PowerShell logging / 4104) and, immediately after, the execution of an unsigned binary by the Electron app process (4688/Sysmon 1 with Signed=false) is the chain. AV/EDR flags the msfvenom binary. A latest.yml appearing on a writable SMB share is the preceding indicator (FIM).

Defence. Upgrade electron-updater to a patched version, escape/validate file names, and apply fail-closed validation: on any signature verification error, abort the install. Serve updates only over HTTPS from a non-tamperable origin. Related to file-upload RCE when the delivery channel is an upload.