Identify macOS applications with unpatched Electron Framework versions as relates to CVE-2023-4863

electron-patches.sh

#!/bin/bash
set -e

# original script (requires DevTools):
# find /Applications -type f -name "*Electron Framework*" -exec \
#   sh -c "echo  \"{}\" && strings \"{}\" | grep '^Chrome/[0-9.]* Electron/[0-9]' | head -n1 && echo " \;
# source: https://infosec.exchange/@TomSellers/111126339492371432

# osquery version:
# WITH _e AS(
#   SELECT CONCAT(path, '/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist') AS path  
#   FROM apps  
# )  
# SELECT path, value
# FROM _e JOIN plist USING(path) WHERE key = 'CFBundleVersion';
# source: https://macadmins.slack.com/archives/CD07P8VDF/p1695866012785659

# Usage: Is $1 at least $2
is_at_least () {
  if [[ $1 == "$2" ]]; then
    return 0
  fi
  local IFS=.
  local i ver1=($1) ver2=($2)
  for ((i=${#ver1[@]}; i<${#ver2[@]}; i++)); do
    ver1[i]=0
  done
  for ((i=0; i<${#ver1[@]}; i++)); do
    if [[ -z ${ver2[i]} ]]; then
      ver2[i]=0
    fi
    if ((10#${ver1[i]} > 10#${ver2[i]})); then
      return 0
    fi
    if ((10#${ver1[i]} < 10#${ver2[i]})); then
      return 1
    fi
  done
  return 0
}

pushd /Applications &> /dev/null
for APP in */; do
  if [[ -d "${APP}Contents/Frameworks/Electron Framework.framework" ]]; then
    VER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleVersion" "${APP}Contents/Frameworks/Electron Framework.framework/Versions/A/Resources/Info.plist" 2> /dev/null)
    if [[ ! $VER ]] || [[ $VER =~ [^0-9\.]+ ]]; then
      APP_VER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "${APP}Contents/Info.plist" 2> /dev/null)
      echo "${APP::${#APP}-5} v$APP_VER contains indeterminant Electron version $VER"
      continue
    fi
    PATCHED=true
    if is_at_least "$VER" "26" && ! is_at_least "$VER" "26.2.1"; then
      PATCHED=false
    elif is_at_least "$VER" "25" && ! is_at_least "$VER" "25.8.1"; then
      PATCHED=false
    elif is_at_least "$VER" "24" && ! is_at_least "$VER" "24.8.3"; then
      PATCHED=false
    elif is_at_least "$VER" "23" && ! is_at_least "$VER" "24"; then
      PATCHED=false
    elif is_at_least "$VER" "22" && ! is_at_least "$VER" "22.3.24"; then
      PATCHED=false
    elif ! is_at_least "$VER" "22"; then
      PATCHED=false
    fi
    if [[ $PATCHED == false ]]; then
      APP_VER=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" "${APP}Contents/Info.plist" 2> /dev/null)
      echo "${APP::${#APP}-5} v$APP_VER contains unpatched Electron version $VER"
    fi
  fi
done
popd &> /dev/null

If using as a command or fact in Addigy, remove lines 1 & 2. Discussion here: https://macadmins.slack.com/archives/C0JP3M6MB/p1695842576358889

Shared to MacAdmins Slack here: https://macadmins.slack.com/archives/CGXNNJXJ9/p1695920968172159