Access Control Bypass Affecting tauri package, versions >=1.0.0 <1.0.7 >=1.1.0 <1.1.2
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-TAURI-3110425
- published 9 Nov 2022
- disclosed 8 Nov 2022
- credit MessyComposer
Introduced: 8 Nov 2022
CVE-2022-41874 Open this link in a new tabHow to fix?
Upgrade tauri to version 1.0.7, 1.1.2 or higher.
Overview
Affected versions of this package are vulnerable to Access Control Bypass due to incorrect escaping of special characters in paths selected via the file dialog and drag and drop functionality, which allows partially bypassing the fs scope definition.
Note:
On Linux or MacOS based systems it was possible to use the *, ** and [a-Z] patterns inside a path, which allows reading the content of sub directories and single character files in a folder, where only specific files or the directory itself were allowed.
On Windows [a-Z] was the possible bypass pattern, as * is not treated as a valid path component. This implies that only single character files inside an already allowed directory were unintentionally accessible.
Workaround
Users who are unable to upgrade to the fixed version can disable the dialog and fileDropEnabled component inside the tauri.conf.json.