Tauri vulnerable to path traversal
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.0.8, 1.1.3, 1.2.3, 2.0.0-alpha.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: partial
Summary
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- tauri-apps tauri
From 1.0.0 · fixed in 1.0.8; From 1.1.0 · fixed in 1.1.3; From 1.2.0 · fixed in 1.2.3; From 2.0.0-alpha.0 · fixed in 2.0.0-alpha.2
- tauricrates.io
From 1.0.0 · fixed in 1.0.8
- tauricrates.io
From 1.1.0 · fixed in 1.1.3
- tauricrates.io
From 1.2.0 · fixed in 1.2.3
- tauricrates.io
From 2.0.0-alpha.0 · fixed in 2.0.0-alpha.2