PT-2024-26386 · Tauri · Tauri
Begleynk
·
Published
2024-05-23
·
Updated
2024-05-24
·
CVE-2024-35222
CVSS v3.1
5.9
Medium
| Vector | AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Tauri versions prior to 1.6.7
Tauri versions prior to 2.0.0-beta.19
Description
The issue allows remote origin iFrames in Tauri applications to access the Tauri IPC endpoints without being explicitly allowed. This bypasses the origin check and enables iFrames to access the IPC endpoints exposed to the parent window. For exploitation, an attacker must have script execution in a script-enabled iFrame of a Tauri application. Valid commands with potentially unwanted consequences could be invoked by an attacker controlling the content of an iframe running inside a Tauri app.
Recommendations
For versions prior to 1.6.7, consider using a dedicated window for untrusted origins instead of iFrames, or disable script execution within the iFrame as a workaround.
For versions prior to 2.0.0-beta.19, use either a dedicated window or multiple WebViews in the main window to simulate iFrame behavior on Linux, or use dedicated windows or disable script execution inside the iFrame on other platforms.
Update to version 1.6.7 or later for v1 Tauri applications.
Update to version 2.0.0-beta.19 or later for v2 Tauri applications.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tauri