CVE-2022-41874 Tauri Filesystem Scope can be Partially Bypassed
Attackers can bypass filesystem scope restrictions to access neighboring files via malicious file selection in Tauri desktop applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-41874?
CVE-2022-41874 is a low-severity path traversal vulnerability in tauri-apps tauri, published on 10 Nov 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Tauri is a framework for building binaries for all major desktop platforms. In versions prior to 1.0.7 and 1.1.2, Tauri is vulnerable to an Incorrectly-Resolved Name. Due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, it is possible to partially bypass the `fs` scope definition. It is not possible to traverse into arbitrary paths, as the issue is limited to neighboring files and sub folders of already allowed paths. The impact differs on Windows, MacOS and Linux due to different specifications of valid path characters. This bypass depends on the file picker dialog or dragged files, as user selected paths are automatically added to the allow list at runtime. A successful bypass requires the user to select a pre-existing malicious file or directory during the file picker dialog and an adversary controlled logic to access these files. The issue has been patched in versions 1.0.7, 1.1.2 and 1.2.0. As a workaround, disable the dialog and fileDropEnabled component inside the tauri.conf.json.
Which versions are affected by CVE-2022-41874?
5 open source packages ship an affected version, including Tauri and tauri. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Tauri crates.io | From 1.0.0 | 1.0.7 |
Tauri crates.io | From 1.0.0 | 1.0.7 |
Tauri crates.io | From 1.1.0 | 1.1.2 |
Tauri crates.io | From 1.1.0 | 1.1.2 |
tauri crates.io | From 1.0.0 | 1.0.7, 1.1.2 |
Products include Tauri Tauri.
How do I fix CVE-2022-41874?
Upgrade Tauri to a fixed version for your release line: 1.0.7 or 1.1.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-41874 being exploited?
There is no known exploitation of CVE-2022-41874 in the wild and no public exploit code.
Other vulnerabilities in tauri-apps tauri
- CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
- CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
- CVE-2022-46171 Tauri vulnerable to path traversal
- CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
- CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Sources
Also known as GHSA-q9wv-22m9-vhqh, RUSTSEC-2022-0091.