Discord Desktop App RCE
Hi all! Discord Employee here that was involved in the remediation of this exploit! I just wanted to clarify with a timeline, and explanation as to why we had context isolation disabled!<p>9:21 PM on July 16, 2020 we received a very detailed report from Masato outlining this exploit.<p>9:34 PM: Ticket acknowledged - and we began a deploy that would disable sketchfab embeds within the app, to remediate this known attack vector.<p>10:00 PM: Update pushed to stable to disable all existing sketchfab embeds.<p>Thanks to the detailed report, we were able to go from a report to a fix deployed to stable in ~40 minutes!<p>Following that, the next day we deployed a better update as we understood more about the issue (which was the sandbox attribute on the iframe.) In addition, we also paid out $5,000 for this bounty, even though the main fault that lead to RCE was due to a bug in Electron (CVE-2020-15174) which allowed for a bypass of our CSP, by allowing the main window to be navigated to a different domain.<p>----<p>As for context isolation, a lot of the code that had been written was not compatible with contextIsolation - and required significant work to refactor. For example, due to the way that objects needed to be cloned to pass through the bridge, the internal APIs that existed needed to be entirely reworked, as they were not really compatible with this model. We began this work in April shortly after we worked out all the quirks required to upgrade to Electron 7 which is when contextBridge would be available for us to turn on contextIsolation. It was <i>not</i> as simple as flipping a boolean from false -&gt; true, and required a re-work of our native modules and their internal APIs, and also doing so in a way that would be backwards &amp; forwards compatible with the various app versions that we had shipped in the wild - in addition to dealing with some performance regressions that needed work-arounds in the new context isolated world.<p>In August, we shipped context isolation to our Stable release channel and gave Masato the green light for disclosure - which leads us to today!