Hacking JavaScript Desktop apps with XSS and RCE

The workshop starts with why companies build desktop apps in JavaScript, citing well-known Electron products, and explains how an Electron app splits into a privileged main process and renderer processes that exchange messages over IPC. It then covers a starting audit: running npm audit for outdated dependencies, reviewing the web preferences in main.js, and running electronegativity to flag common issues.

The middle of the session works through lab applications. An XSS sink assigned to innerHTML is shown to become command execution when node integration is enabled, since injected script can reach Node APIs. The presenter then layers defenses: disabling node integration, adding a content security policy, switching to textContent, and sanitizing HTML with DOMPurify. Further labs cover a preload script running with context isolation disabled, where overriding a built-in function bypasses a protocol check and a file URL runs code on Windows, and a main-process IPC listener that accepts an update URL and leads to a reverse shell on Linux.

The takeaway is to review configuration and dependencies first, treat renderer XSS as a likely path to code execution when node integration or context isolation is off, and apply fixes in layers. The presenter notes the techniques also apply to other desktop app platforms.