# Signature Validation Bypass Leading to RCE In Electron-Updater

electron-updater passed the update filename unescaped into a PowerShell Get-AuthenticodeSignature command, letting a malicious latest.yml break out and skip signature checks, yielding RCE.

- Payout: Research
- Severity: high
- Program: electron-updater
- Credited: Doyensec
- Disclosed: 2020-02-23
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2020/02/24/electron-updater-update-signature-bypass.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2020-02-24-electron-updater-update-signature-bypass-html
- Tags: domain:desktop impact:rce kind:research platform:research sev:high tech:nodejs tech:windows technique:chained technique:source-review vuln:command-injection vuln:misconfiguration vuln:signature-replay

**Target:** Windows auto-update mechanism (latest.yml / NSIS installer)
**Root cause:** The update filename from latest.yml is interpolated unescaped into a PowerShell -Command string; a single quote breaks the Get-AuthenticodeSignature call, causing a parse error that the catch block treats as 'ignore signature validation' (fail open).
**Steps:**
1. Host a malicious latest.yml on the update server (or MITM) with a filename containing a single quote, e.g. `v'ulnerable-app-setup-1.2.3.exe`.
2. Compute the sha512 of the malicious installer and base64-encode it into the yml `sha512` fields so hash checks pass.
3. Victim app fetches latest.yml, downloads the file, and runs `Get-AuthenticodeSignature '<path>'` via execFile powershell.
4. The quote breaks the PowerShell command, producing a parse error caught by the try/catch which resolves null (validation ignored).
5. Installer executes; optionally use `isAdminRightsRequired` to run elevated. Alternatively inject `v';calc;'...` for direct command injection.
**How found:** During a customer engagement reviewing the update mechanism, they read the electron-updater source and noticed the tempUpdateFile variable was passed unescaped into a PowerShell -Command string, and that the catch block resolved null (fail open) on any error.
**Exploitation:** Attacker controls the update server (compromise) or MITMs the update channel (no cert pinning). Serving a crafted latest.yml with a quote-containing filename and matching sha512 causes electron-updater to skip signature verification and execute the attacker's installer, giving code execution and persistence; isAdminRightsRequired escalates to Administrator.
**Escalation:** Backdoor the installer and set isAdminRightsRequired to gain Administrator privileges; persistence via auto-update.
**Insight:** When a security check shells out to an interpreter with interpolated strings, look for a fail-open catch: any parse/exec error that resolves 'valid' turns a quoting bug into a full bypass. Filenames from remote manifests are attacker-controlled input to that command line.