GitHub Advisoryadvisory · crates.io

GHSA-28m8-9j7v-x499 Tauri's readDir Endpoint Scope can be Bypassed With Symbolic Links

MEDIUM Published 2022-09-16 Modified 2022-09-22 Official page ↗
Aliases
CVE-2022-39215
Ecosystem
crates.io
Packages
tauri
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-22, CWE-59
Reviewed
2022-09-16

Affected packages

• crates.io tauri: < 1.0.6 → fixed in 1.0.6

Description

Impact Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This required a crafted symbolic link or junction folder inside an allowed path of the `fs` scope. No arbitrary file content could be leaked. Patches The issue has been resolved in https://github.com/tauri-apps/tauri/pull/5123 and the implementation now properly checks if the requested (sub) directory is a symbolic link outside of the defined `scope`. Workarounds Disable the `readDir` endpoint in the `allowlist` inside the `tauri.conf.json`. For more information This issue was initially reported by martin-ocasek in #4882. If you have any questions or comments about this advisory: • Open an issue in tauri • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-39215 Tauri is a framework for building binaries for all major desktop platforms. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-59 Improper Link Resolution Before File Access weakness

References