electerm vulnerabilities

In electerm, prior to version 3.7.9, there is a remote code execution (RCE) vulnerability in the SFTP file editing feature. The filename is passed unsanitized into the command line, allowing an attacker to execute malicious code on the user's machine.

In versions prior to 3.7.16 of the electerm client, the runWidget function in load-widget.js constructs a file path by concatenating user-supplied widget identifiers without any sanitization. This allows an attacker to execute arbitrary JavaScript files on the victim's system.

Electerm, a terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client, is vulnerable to arbitrary local code execution in versions from 3.0.6 to before 3.8.15. Exploiting this vulnerability requires clicking a crafted electerm://... link or opening a crafted shortcut/command.

Electerm is a terminal client that in versions 3.8.15 and prior does not validate protocols for URLs clicked in the terminal. Attackers can exploit this to execute arbitrary code or access local files on the victim's machine if the victim clicks a displayed link.

In the electerm client prior to version 3.3.8, a command injection vulnerability exists that allows an attacker to append malicious version strings into an exec command without validation. This issue has been patched in version 3.3.8.

In the electerm client prior to version 3.3.8, a command injection vulnerability allows an attacker to inject malicious code into the exec command. This issue has been patched in version 3.3.8.

electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process.

electerm prior to version 3.11.11 constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf(), mv(), and cp() functions. A malicious SSH or SFTP server can provide a filename containing quote characters and shell metacharacters, leading to arbitrary command execution with the desktop user's privileges. This issue is fixed in version 3.11.11.

electerm prior to version 3.11.11 uses remote-supplied filenames directly with path.join() while receiving Zmodem and Trzsz transfers. A malicious SSH server can provide a filename containing traversal components such as ../, allowing writes outside the selected download directory and overwriting files accessible to the desktop user. This issue is fixed in version 3.11.11.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in src/client/components/rdp/file-transfer.js passes the server-controlled CLIPRDR filename fileInfo.name to osResolve without sanitization. This issue is fixed in version 3.15.120.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.186, electerm allows an authenticated WebSocket client to invoke unintended internal functions through client-controlled func values in upgrade-func in src/app/server/dispatch-center.js and handleFs in src/app/server/fs.js, exposing Upgrade and fsExport methods that can execute commands, open files, mutate the filesystem, or terminate the process. This issue is fixed in version 3.15.186.

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in src/client/components/file-transfer/transfer.jsx pass server-supplied file.name and folder.name values to resolve without sanitization. This issue is fixed in version 3.15.120.

electerm before version 3.15.120 allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size. This is because calcLocal inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. The issue is fixed in version 3.15.120.

electerm before version 3.15.120 allows a malicious SFTP server to write attacker-controlled content outside the temporary directory. This is because the server-controlled filename used by editWithSystemEditor is interpolated into path.resolve without sanitization. The issue is fixed in version 3.15.120.