oskarsv

that electronSafeIpc API is actually not that interesting and a completely standard way to do things for ElectronJS apps.

No, I do agree - from my perspective C/C++ class bugs are more difficult. Maybe they see this as magic as well.

Still, it was painstaking work and in either case CountryX will easily surpass those difficulties.

please check out how much code MS Teams actually has, before statements like this :)

(it’s more than 30MB of compressed JS)

There is no timeline besides when I reported it and now minus 2wks. They never told me when the fix was deployed.

There is little value in going through the email chains to note each date:(. Final decision was made 2020-11-19

sure, add guest accounts to that and we are almost on the same page.

I can’t call this “spoofing” as there are many many things you can do wih it

only as a thought exercise. the ability to 'switch off the internet' (115 million daily active big corp users) is tempting, but no, not really :)

Yeah, although technically it's "out of scope", I think there are times when you should stop debating the technicalities and consider the business impact.

I mean, do you look at that demo and think "yeah, that's technically just 'important' let's fix it in 2 months"?

no, as you can see in the first demo it could be completely silent.

not saying you are safe - I don’t know :)

to simplify - no it’s not enabled

the real answer is more complicated as it is not necessarily a global setting and depends on what you call a “sandbox”

there are different levels of security for ElectronJS, some, like in this case are not enough.

I think it will take a long time before we can call ElectronJS secure. there are regular sandbox escapes and that is from what we know publicly

you can find both disclosure dates and versions in the report.

As for when it was fixed - I have no idea, as they never told me, one day it just was.

I wrote this. This is one of five similar reports for MS Teams.

Even outside RCE, just consider the impact of access to SSO tokens and wormability :)

thank you, appreciate some positivity :)

Context matters. In this case it was a challenge because of previous research and I would've done it just for fun and the experience. I'm lucky I can afford to do that. Doesn't mean I don't value compensation.

In other cases maybe yes, maybe no - for some nonprofit, maybe someone needs help? are they a business and can they afford to compensate this kind of work? maybe it is some prominent product? there is no simple answer