CVE-2022-39215

Executive Summary

CVE-2022-39215 affects the Tauri application framework (versions prior to 1.0.6), which is used to build cross-platform desktop binaries. The vulnerability allows a local attacker to bypass the filesystem scope restrictions of the readDir endpoint by placing a crafted symbolic link or junction folder inside an allowed path within the fs scope, thereby enabling unauthorized directory listings of arbitrary locations on the host filesystem. The vulnerability is classified as high severity (CVSS 8.3) and was resolved in Tauri 1.0.6 by implementing proper canonicalization and symlink checks before listing directories.

Technical Analysis

The readDir endpoint in Tauri is designed to expose directory listing functionality to the frontend/webview component of an application, but only within a sandboxed set of directories defined by the fs scope configuration in tauri.conf.json. The scope is intended to prevent the application's frontend from reading arbitrary filesystem directories on the user's machine.

The flaw stems from the lack of proper path canonicalization when the readDir endpoint is invoked with the recursive flag (i.e., scanning a directory and all its subdirectories). The implementation validates whether the starting directory is within the allowed scope, but does not re-validate each subdirectory encountered during recursive traversal. This creates a classic "link following" vulnerability (CWE-59): if an attacker can place a symbolic link (on Unix/Linux/macOS) or a junction point (on Windows) inside an allowed directory, the recursive traversal will silently follow that link and enumerate the contents of directories outside the fs scope.

The attack surface is local and requires low privilege: the attacker must be able to create files or directories (or convince the user to do so) inside a path that the Tauri application is permitted to list. The impact is limited to directory listing disclosure — no arbitrary file content can be read through this flaw, only names and directory structures are exposed. However, this still leaks sensitive information about the host system's layout and file organization.

The patched version (1.0.6) resolves the issue by canonicalizing requested paths and checking whether any subdirectory encountered during traversal is a symbolic link that points outside the allowed scope; if so, it is excluded from the listing.

Exploitation Scenarios

Step 1 — Reconnaissance/Preparation: An attacker with local access to the target system identifies a Tauri application using a version < 1.0.6 that exposes the readDir endpoint to its webview. The attacker determines which directories are in the application's fs scope (e.g., $HOME/Documents or an application-specific data folder) by inspecting the frontend code, configuration files, or via trial-and-error probing of the endpoint.

Step 2 — Trigger Mechanism: The attacker creates a symbolic link within an allowed directory: for example, inside the scoped Documents folder, they create a symlink (Unix: ln -s /etc /home/user/Documents/secret_links) pointing to a sensitive out-of-scope directory (e.g., /etc, C:\Windows\System32, or another user's home directory). On Windows, a junction folder (NTFS junction point) could be used.

Step 3 — Exploitation Execution: The attacker invokes the application's readDir endpoint (via the webview's JavaScript interface, using the Tauri API) with the recursive flag set to true on the allowed root directory. The vulnerable implementation does not resolve the symlink before recursing into it; it simply follows the link and enumerates the contents of the target directory, returning the listing (directory names and file names) to the frontend, which then transmits it to the attacker-controlled page or is otherwise accessible.

Step 4 — Post-Exploitation Impact: The attacker obtains a directory listing of the out-of-scope path, revealing sensitive information such as system configuration paths, usernames, application names, or the layout of other users' files. This information can be used to further refine attacks — for example, identifying target files for subsequent data exfiltration attempts (if other endpoints have read capabilities) or mapping the system for lateral movement. No file contents are directly leaked.

No public PoC is available for this CVE; the attack chain is inferred from the vulnerability class (path traversal via symlink bypass of scope validation) and the NVD description.

Impact Assessment

Business Impact: Medium to High. The vulnerability requires local access and a low-privilege position, but it undermines the security boundary of a Tauri application. The confidentiality impact is moderate (directory listings of arbitrary paths), but in the CVSS vector this maps to a High confidentiality impact, likely due to the potential exposure of sensitive system metadata and the fact that this is only one hop away from other filesystem read primitives in Tauri's API surface.

Affected Systems: Any desktop application built with Tauri < 1.0.6 that enables and exposes the readDir endpoint via the fs allowlist. This includes Linux, macOS, and Windows builds.

CVSS Reference: The CVSS 8.3 score reflects a High severity. The vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates: Local attack vector, Low attack complexity, Low privileges required, No user interaction, Changed scope (the vulnerability affects resources beyond the vulnerable component's security scope), and High impact across confidentiality, integrity, and availability. The High integrity/availability impacts suggest the issue could be chained with other Tauri endpoints to achieve broader modification or denial-of-service effects beyond simple listing leakage.

Blast Radius: The vulnerability affects any user of the vulnerable application. The enterprise risk is moderate: a malicious insider or a malware sample already resident on a user's machine could use this flaw to map the filesystem and enumerate sensitive directories, facilitating further attacks. The low EPSS score (0.008) suggests limited active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Tauri readDir Symlink Scope Bypass Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to list directories outside the fs scope via symlink traversal in Tauri applications (CVE-2022-39215)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39215
author: valtersit.com
date: 2024/01/01
logsource:
    product: linux
    service: auditd
detection:
    selection_path:
        type: SYSCALL
        syscall: getdents
    selection_symlink:
        type: SYSCALL
        syscall: readlink
        success: true
    condition: selection_path and selection_symlink
falsepositives:
    - Legitimate recursive directory scanning by the application on allowed paths
level: medium

YARA Rule

rule Detect_Tauri_Symlink_Traversal_Code
{
    meta:
        author = "valtersit.com"
        description = "Detects likely Tauri application code patterns vulnerable to readDir symlink scope bypass (CVE-2022-39215)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-39215"
        date = "2024-01-01"
    strings:
        $a = "readDir" ascii wide
        $b = "readDirRecursive" ascii wide
        $c = "symbolic_link" ascii wide
        $d = "junction" ascii wide
        $e = "allowlist" ascii wide
        $f = "fs" ascii wide
    condition:
        uint16(0) == 0x5A4D and all of them and file_size < 5MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2022-39215 - Tauri readDir Symlink Scope Bypass Attempt"; flow:established,to_server; content:"readDir"; http_uri; content:"recursive"; distance:0; http_uri; content:"symlink"; distance:0; http_uri; classtype:attempted-recon; sid:202239215; rev:1; reference:cve,2022-39215;)

Elastic Detection

ANY WHERE
  process.name : "*.exe" OR process.name : "*app*"
  OR
  process.name : "tauri*"
  AND process.command_line : "*readDir*"
  AND process.command_line : "*recursive*"
  AND process.command_line : "*symlink*"

Splunk SPL Query

index=filesystem_monitor sourcetype=linux_audit OR sourcetype=WinEventLog
  (process_name=*app* OR process_name=*tauri*)
  AND (action=getdents OR action=NTFS_read)
  AND path=*/
  | stats count by host, process_name, path
  | where count > 100

Wazuh OSSEC Rule

<group name="tauri_cve,">
  <rule id="100101" level="8">
    <if_sid>550</if_sid>
    <match>readDir</match>
    <regex>recursive</regex>
    <description>Tauri readDir symlink scope bypass attempt detected (CVE-2022-39215)</description>
    <group>syscall,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence is available from any tracked source, despite the vendor having released version 1.0.6. This discrepancy suggests the reporting pipeline has not correlated the fix with this CVE. Treat any Tauri version prior to 1.0.6 as fully vulnerable.

1) Immediate Mitigations (if upgrade is not possible):

• Disable the readDir endpoint entirely by removing it from the allowlist in tauri.conf.json. This is the vendor-recommended workaround.
• Restrict the fs scope to the narrowest possible set of directories.
• If readDir must remain enabled, modify the scope to exclude writable directories where low-privilege users (or untrusted content) could plant a symlink or junction.

2) Patch / Upgrade Steps:

• Upgrade Tauri to version 1.0.6 or later, which implements path canonicalization and per-directory symlink validation when readDir is invoked recursively.
• Rebuild all application binaries with the patched framework version and redistribute them to end users.
• Verify that the application's dependency lockfiles (Cargo.lock for Rust-based tooling) reference Tauri >= 1.0.6.

3) Long-Term Hardening:

• Adopt the principle of least privilege for the fs allowlist: only expose directories that are strictly necessary for application functionality.
• Implement runtime monitoring for recursive directory listings that traverse beyond expected root paths.
• Enforce filesystem-level access controls (ACLs) on directories visible to the application to prevent untrusted users from creating symlinks or junctions in the first place.
• Subscribe to the Tauri GitHub advisory feed or the project's release notes to be notified of future security advisories.
• If the application processes untrusted archive files or downloads, consider extracting them to dedicated sandbox directories that are excluded from the fs scope.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39215
• Tauri GitHub Advisory (if available — the CNA title references "readDir Endpoint Scope can be Bypassed With Symbolic Links in Tauri"): https://github.com/tauri-apps/tauri/security/advisories
• Tauri Release Notes for v1.0.6: https://github.com/tauri-apps/tauri/releases (check changelog for the canonicalization fix)
• MITRE CWE-59 Reference: https://cwe.mitre.org/data/definitions/59.html
• CISA KEV: No record for CVE-2022-39215 as of the data cutoff.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns are associated with this CVE. The EPSS score of 0.00802 (53.2% percentile) indicates a very low probability of exploitation in the wild. No public PoC or exploit code has been published. As of the data provided, this vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.