PT-2022-27785 · Tauri · Tauri

Lucasfernog · Published 2022-12-22 · Updated 2023-01-04 · CVE-2022-46171

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tauri versions prior to the latest release Tauri versions 1.x prior to the backported patch

Description The filesystem glob pattern wildcards *, ?, and [...] match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As ** allows for sub directories, the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches.

Recommendations For Tauri versions prior to the latest release, update to the latest release to resolve the issue. For Tauri versions 1.x, apply the backported patch to resolve the issue. As a temporary workaround, consider restricting the use of the *, ?, and [...] glob patterns in fs scopes to minimize the risk of exploitation. Avoid using the dialog.open component with the recursive option set to false until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-46171

GHSA-6MV3-WM7J-H4W5

Affected Products

Tauri

References · 12

• 🔥 https://github.com/tauri-apps/tauri/security/advisories/GHSA-6mv3-wm7j-h4w5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46171.json · Exploit
• https://github.com/tauri-apps/tauri/commit/f0602e7c294245ab6ef6fbf2a976ef398340ef58 · Patch
• https://github.com/tauri-apps/tauri/commit/72389b00d7b495ffd7750eb1e75a3b8537d07cf3 · Patch
• https://osv.dev/vulnerability/GHSA-6mv3-wm7j-h4w5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46171 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46171 · Vendor Advisory
• https://github.com/tauri-apps/tauri · Note
• https://github.com/tauri-apps/tauri/commit/14d567f7ecb25a6d1024cf3d796f86aee89d0dd4 · Note
• https://t.me/cibsecurity/55242 · Telegram Post
• https://t.me/cvenotify/40508 · Telegram Post
• https://t.me/cvenotify/40496 · Telegram Post