CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
Developers using a specific Vite configuration may leak Tauri updater private keys, allowing attackers to bypass update signatures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46115?
CVE-2023-46115 is a high-severity vulnerability in tauri-apps tauri, published on 19 Oct 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri documentation used an insecure example configuration in the `Vite guide` to showcase how to use Tauri together with Vite. Copying the following snippet `envPrefix: ['VITE_', 'TAURI_'],` from this guide into the `vite.config.ts` of a Tauri project leads to bundling the `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD` into the Vite frontend code and therefore leaking this value to the released Tauri application. Using the `envPrefix: ['VITE_'],` or any other framework than Vite means you are not impacted by this advisory. Users are advised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application.
Which versions are affected by CVE-2023-46115?
8 open source packages ship an affected version, including @tauri-apps/cli and tauri-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@tauri-apps/cli npm | From 1.0.0 | 1.5.6 |
@tauri-apps/cli npm | From 1.0.0 | 1.5.6 |
@tauri-apps/cli npm | From 2.0.0-alpha.0 | 2.0.0-alpha.16 |
@tauri-apps/cli npm | From 2.0.0-alpha.0 | 2.0.0-alpha.16 |
tauri-cli crates.io | From 1.0.0 | 1.5.6 |
tauri-cli crates.io | From 1.0.0 | 1.5.6 |
2 more packages
tauri-cli crates.io | From 2.0.0-alpha.0 | 2.0.0-alpha.16 |
tauri-cli crates.io | From 2.0.0-alpha.0 | 2.0.0-alpha.16 |
Products include Tauri Tauri.
How do I fix CVE-2023-46115?
Upgrade @tauri-apps/cli to a fixed version for your release line: 1.5.6 or 2.0.0-alpha.16.
Is CVE-2023-46115 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46115 exists.
Other vulnerabilities in tauri-apps tauri
- CVE-2022-39215 The readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri
- CVE-2022-46171 Tauri vulnerable to path traversal
- CVE-2026-42184 Tauri: Origin Confusion Allows Remote Pages to Invoke Local-Only IPC Commands
- CVE-2023-34460 Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
- CVE-2023-31134 Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Sources
Also known as GHSA-2rcp-jvr4-r259.