CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
Attackers can bypass filesystem scope restrictions to list directories outside allowed paths using symbolic links in Tauri applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-39215?
CVE-2022-39215 is a high-severity path traversal vulnerability in tauri-apps tauri, published on 15 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. The issue has been resolved in version 1.0.6 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Users are advised to upgrade. Users unable to upgrade should disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`.
Which versions are affected by CVE-2022-39215?
3 open source packages ship an affected version, including tauri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tauri crates.io | All versions | 1.0.6 |
tauri crates.io | All versions | 1.0.6 |
tauri crates.io | From 0.0.0-0 | 1.0.6 |
Products include Tauri Tauri.
How do I fix CVE-2022-39215?
Upgrade tauri to 1.0.6 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-39215 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-39215 exists.
Other vulnerabilities in tauri-apps tauri
- CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
- CVE-2022-46171 Tauri vulnerable to path traversal
- CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
- CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
- CVE-2023-31134 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Sources
Also known as GHSA-28m8-9j7v-x499, RUSTSEC-2022-0088.