Improper Input Validation Affecting tauri-plugin-shell package, versions <2.2.1

tauri-plugin-shell is a plugin that allows you to spawn child processes and manage files and URLs using their default application.

Affected versions of this package are vulnerable to Improper Input Validation of allowed protocols in the open endpoint. An attacker can execute arbitrary code on the system by passing untrusted input that specifies dangerous protocols such as file://, smb://, or nfs://.

Note:

This is only exploitable if the open endpoint is directly exposed to application users or if code execution occurs in the frontend of a Tauri application.

This vulnerability can be mitigated by setting the shell plugin configuration value open to true, which restricts the allowed protocols to mailto, http and https. Alternatively, defining a non-matching regex or removing shell:default and all instances of shell:allow-open from the capabilities can prevent the use of the open endpoint.

This is a windows specific proof of concept.

1. Use create-tauri-app to make a new Tauri app;

2. Run tauri add shell to add the shell plugin;

3. Execute await window.__TAURI_INTERNALS__.invoke("plugin:shell|open", {path: "file:///c:/windows/system32/calc.exe"}); in the developer console;

4. Observe the calculator being executed.

• GitHub Commit