PT-2023-5599 · Tauri · Tauri

Chip-Crabnebula + 1 · Publicado 2023-06-21 · Atualizado 2023-07-05 · CVE-2023-34460

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tauri versions 1.4.0

Description The issue is related to a regression in the Filesystem scope check for dotfiles on Unix systems, introduced in the 1.4.0 release. This regression affects Tauri applications using wildcard scopes in the fs endpoint, allowing implicit access to dotfiles. The problem can be exploited by a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Tauri version 1.4.0, update to version 1.4.1 to resolve the issue. As a temporary workaround, consider restricting access to the fs endpoint until the update is applied.

Exploit

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

BDU:2023-06254

CVE-2023-34460

GHSA-WMFF-GRCW-JCFM

Produtos afetados

Tauri

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34460.json · Exploit
• https://github.com/tauri-apps/tauri · Nota
• https://github.com/tauri-apps/tauri/pull/6969#discussion_r1232018347 · Correção
• https://github.com/tauri-apps/tauri/commit/066c09a6ea06f42f550d090715e06beb65cd5564 · Correção
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-wmff-grcw-jcfm · Nota
• https://github.com/tauri-apps/tauri/pull/7227 · Correção
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34460 · Nota de Segurança
• https://google.com/search?q=CVE-2023-34460&rlz=1C1GCEU_ruRU1069RU1070&oq=CVE-2023-34460&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQABiiBDIGCAIQRRg80gEHNDE1ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8#ip=1 · Nota
• https://osv.dev/vulnerability/GHSA-wmff-grcw-jcfm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-34460 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-06254 · Nota de Segurança
• https://t.me/cvenotify/53014 · Publicação no Telegram
• https://google.com/search?q=CVE-2023-34460&rlz=1C1GCEU_ruRU1069RU1070&oq=CVE-2023-34460&gs_lcrp=EgZjaHJvbWUyBggAEEUYOTIHCAEQABiiBDIGCAIQRRg80gEHNDE1ajBqN6gCALACAA&sourceid=chrome&ie=UTF-8#ip=1 · Nota