Junyu Zhou - Web2Own: Attacking Desktop Apps from Web Security's Perspective
Demonstrates how web security vulnerabilities (XSS, SSRF, path traversal) in Electron desktop applications escalate to full OS code execution.
Summary
Attacking Electron Desktop Applications
Junyu Zhou presents a systematic methodology for attacking Electron-based desktop applications using web security techniques, demonstrating that web vulnerabilities in desktop contexts result in full OS-level code execution.
Electron Architecture
Electron applications bundle Chromium and Node.js, creating a hybrid web/desktop environment. The main process has full Node.js capabilities (file system, shell, network); renderer processes run web content in a sandbox. The critical boundary is the IPC bridge between renderer and main.
XSS to RCE
In Electron apps that disable contextIsolation or enable nodeIntegration in renderer processes, stored XSS in rendered content executes arbitrary JavaScript with full Node.js capabilities — providing immediate file system access, shell command execution, and credential extraction from the local system.
Real-World Targets
Zhou demonstrates successful exploitation of XSS vulnerabilities in Slack (before fixes), VS Code extensions, and several popular productivity applications, achieving code execution through seemingly low-severity web vulnerabilities.
Related talks
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.
Main Stage·20 min
Mikhail Shcherbakov · Musard Balliu
Mikhail Shcherbakov and Musard Balliu uncover universal Prototype Pollution gadgets within Node.js core and popular NPM packages, achieving RCE across major applications.
Main Stage·34 min
Eugene Lim
Eugene Lim (spac3sc) explores vulnerabilities in the ubiquitous iCalendar (.ics) standard, demonstrating zero-click XSS, RCE, and credential theft via calendar invites.