PT-2022-24815 · Tauri · Tauri

Martin-Ocasek · Published 2022-08-07 · Updated 2022-09-21 · CVE-2022-39215

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tauri versions prior to 1.0.6

Description Due to missing canonicalization when readDir is called recursively, it was possible to display directory listings outside of the defined fs scope. This required a crafted symbolic link or junction folder inside an allowed path of the fs scope. No arbitrary file content could be leaked.

Recommendations For versions prior to 1.0.6, upgrade to version 1.0.6 or later. As a temporary workaround for users unable to upgrade, disable the readDir endpoint in the allowlist inside the tauri.conf.json.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2022-39215

GHSA-28M8-9J7V-X499

RUSTSEC-2022-0088

Affected Products

Tauri

References · 16

• 🔥 https://github.com/tauri-apps/tauri/issues/4882 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39215.json · Exploit
• https://github.com/tauri-apps/tauri/pull/5123 · Patch
• https://github.com/tauri-apps/tauri/security/advisories/GHSA-28m8-9j7v-x499 · Patch
• https://github.com/tauri-apps/tauri/pull/5123/commits/1f9b9e8d26a2c915390323e161020bcb36d44678 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39215 · Security Note
• https://osv.dev/vulnerability/GHSA-28m8-9j7v-x499 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39215 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0088 · Vendor Advisory
• https://github.com/tauri-apps/tauri · Note
• https://github.com/tauri-apps/tauri/releases/tag/tauri-v1.0.6 · Note
• https://github.com/tauri-apps/tauri/commit/bb178829086e80916f9be190f02d83bc25802799 · Note
• https://crates.io/crates/tauri · Note
• https://t.me/cvenotify/36272 · Telegram Post
• https://t.me/cibsecurity/49859 · Telegram Post