Coolcoolnoworries

**Name of the Vulnerable Software and Affected Versions** SideQuest versions prior to 0.10.35 **Description** The SideQuest desktop application uses deep links with a custom protocol (`sidequest://`) to trigger actions in the application from its web contents. Due to improper sanitization of deep link URLs prior to version 0.10.35, a one-click remote code execution can be achieved when a device is connected and a user clicks a malicious link from within the application. **Recommendations** For versions prior to 0.10.35, update to version 0.10.35 or later to resolve the issue, as the custom protocol links within the electron application are now being parsed and sanitized properly in this version. As a temporary workaround, consider avoiding clicking on links from within the application until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Electron versions prior to 21.0.0-beta.1 Electron versions prior to 20.0.1 Electron versions prior to 19.0.11 Electron versions prior to 18.3.7 **Description** The Electron framework is vulnerable to Exposure of Sensitive Information. When following a redirect, Electron delays a check for redirecting to file:// URLs from other schemes. If the redirect target is a SMB URL, such as `file://some.website.com/`, Windows may connect to that server and attempt NTLM authentication, which can include sending hashed credentials. **Recommendations** For versions prior to 21.0.0-beta.1, upgrade to version 21.0.0-beta.1 or later. For versions prior to 20.0.1, upgrade to version 20.0.1 or later. For versions prior to 19.0.11, upgrade to version 19.0.11 or later. For versions prior to 18.3.7, upgrade to version 18.3.7 or later. As a temporary workaround, prevent redirects to file:// URLs in the `WebContents.on('will-redirect')` event for all WebContents. This can be achieved by adding an event listener to the `web-contents-created` event and checking the URL in the `will-redirect` event. If the URL starts with `file://`, prevent the default behavior.