CVE-2022-46171

Executive Summary

CVE-2022-46171 is a path traversal vulnerability in Tauri, a framework used to build cross-platform desktop applications for Windows, macOS, and Linux. The flaw resides in the filesystem scope validation mechanism, where glob pattern wildcards (*, ?, [...]) match file path literals and leading dots by default. This unintentionally exposes the contents of subfolders within directories that were intended to be explicitly allowed. Applications using filesystem scopes without wildcards are not affected. Successful exploitation could allow a local attacker to read or overwrite arbitrary files within the scope of the application's granted filesystem permissions, potentially leading to code execution or data exfiltration. The issue has been patched in the latest Tauri release, with fixes backported to supported 1.x branches.

Technical Analysis

The vulnerability class is path traversal (CWE-22), specifically arising from an overly permissive glob pattern matching implementation in Tauri's filesystem scope enforcement.

In Tauri, applications declare allowed file paths or directories using glob patterns. These patterns are used by the framework's runtime to intercept and validate filesystem API calls made from the frontend (e.g., webview JavaScript) before allowing them to interact with the host operating system. The scope is designed as a security boundary: only paths matching the declared patterns should be accessible to the application's frontend logic.

The flaw is that the glob matcher treats the wildcards *, ?, and [...] as matching path separators and leading dots in addition to regular characters. In standard glob implementations, * typically matches any sequence of characters except a path separator (/ on Unix, \ on Windows). Here, because these wildcards unintentionally match path literals and leading dots, the matcher effectively widens the set of files that are considered "in scope."

Attack surface mechanism (class-level):

• A Tauri application declares a scope entry, e.g., $APPDATA/*.txt — the intent being that only top-level .txt files in the app data folder are allowed.
• Due to the wildcard matching behavior, an attacker-controlled file path such as $APPDATA/secret/config.toml — or a path containing a dot-prefixed subdirectory like $APPDATA/.hidden/file — would also match the pattern.
• The frontend (potentially compromised via XSS or malicious input) can then invoke Tauri's filesystem API to read or write files that were not intended to be exposed.

The NVD description confirms that scopes using ** behave as expected (as ** is designed to match subdirectories). The issue is isolated to the single-level wildcards.

The root cause is the glob matcher's Unicode/character-class handling being too permissive. As the NVD description notes: "The filesystem glob pattern wildcards *, ?, and [...] match file path literals and leading dots by default."

Because the vulnerability allows the scope to be bypassed, the confidentiality (reading unauthorized files) and integrity (overwriting unauthorized files) of the host system are at risk. The CVSS score is 6.8 (medium-high), with a vector indicating a network attack vector with high attack complexity, low privileges, and user interaction required.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class. No public PoC is available at the time of writing.

Step 1: Reconnaissance/Target Identification An attacker identifies a Tauri-based desktop application as the target. This could be done by inspecting the application binary for Tauri-specific markers (e.g., tauri:// protocol handlers) or by observing that the app ships a WebView2/WKWebView runtime. The attacker must also identify a vector to inject code into the frontend (e.g., a reflected XSS, a malicious link that renders in the webview, or a plugin with an unsanitized input field). Alternatively, the attacker could be a malicious local user with access to the same system.

Step 2: Triggering the Flaw Class The attacker crafts a file path that leverages the glob bypass. For example, if the application scope allows $HOME/Documents/*.pdf, the attacker creates a path like $HOME/Documents/levels/.. /taxrecords.pdf or $HOME/Documents/. hidden/notes.db. Because the wildcard * matches the subfolder separators and leading dots, the path resolves as "in scope."

Step 3: Payload/Execution Method (Class-level) The attacker then calls the Tauri filesystem API from the frontend (e.g., readFile or writeFile — note: these exact function names are not specified in the NVD description and are given here only as illustrative class examples; the actual API surface may differ). The frontend sends the crafted path to the Rust backend, which validates it against the flawed scope. The validation passes, and the backend reads from or writes to the file. The content of the file is then passed back to the frontend JavaScript, where the attacker can exfiltrate it via a network request or use it for further attacks.

Step 4: Post-Exploitation Impact

• Data exfiltration: The attacker reads sensitive files (e.g., configuration files, credentials, private keys) within the application's broader filesystem scope.
• Lateral movement within the host: If the application runs with elevated privileges or has broader scopes on other drives, the attacker may expand access beyond the initial directory.
• Code execution: If the attacker can write to a file that is later loaded/executed by the application or the OS (e.g., a plugin file, a dynamic library, a startup script), code execution under the context of the application user is possible.

Note: No public PoC exists; attack chain is inferred from the vulnerability class. The CVSS vector (AV:N/AC:H/PR:L/UI:R) implies the attacker requires low privileges and user interaction, suggesting that exploiting this fully remotely is difficult, but a local attacker or a compromised frontend process makes it viable.

Impact Assessment

• Confidentiality Impact: HIGH — Scope bypass allows reading files outside the intended allowlist, including system or user data that the application's declared permissions were meant to protect.
• Integrity Impact: HIGH — The attacker can overwrite files within the expanded scope, potentially harming the application's integrity or the user's data.
• Availability Impact: LOW — The vulnerability is primarily a data confidentiality/integrity issue; however, overwriting critical files could cause the application or OS to crash, making availability impact possible but less direct.

Affected Systems: All Tauri applications with filesystem scopes that rely on wildcard patterns (*, ?, [...]) and run versions prior to the latest 1.x patch. Applications that specify exact paths or use the ** double wildcard are not affected.

Blast Radius: The scope is limited to paths reachable by the application's base scope. However, because many Tauri apps request broad scopes like $HOME/** (which includes the user's entire home directory), the blast radius can extend to any file the application user can access.

Attack Vector/Complexity: CVSS 6.8 reflects a high attack complexity (AC:H) and the need for user interaction (UI:R). The attacker must have some way to influence the application to perform file operations on the crafted path — either via a local shell, a frontend XSS, or a malicious file with an embedded script.

Detection Guidance

Sigma Rule

title: Tauri Filesystem Scope Bypass - Suspicious Path Patterns
id: 17f6e3a2-9c10-4f6a-8fe8-26b5f0f9aa77
status: experimental
description: Detects file access attempts to paths containing subfolder traversal or leading-dot directories that may indicate Tauri CVE-2022-46171 exploitation.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46171
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46171
author: ValtersIT Threat Intel
date: 2024/01/05
logsource:
    category: file_access
    product: windows
    service: security
detection:
    selection:
        # Example: monitored process is a Tauri-based app accessing paths with hidden dirs or traversal
        Image|endswith: '\MyApp.exe' # placeholders - replace with actual process name
        TargetFilename|contains:
            - '\.\.'
            - '\.hidden'
            - '\..\' # dot directory name
        # e.g. "C:\Users\*\AppData\Roaming\MyApp\.config\secret.txt"
    condition: selection
level: high
falsepositives:
    - Legitimate application reads of hidden config files if scope explicitly includes them
    - Development environments with test paths containing '..'

Note: Rule uses placeholder process name; tune to actual Tauri app binary.

YARA Rule

rule Tauri_Glob_Bypass_CVE_2022_46171
{
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects Tauri binary strings indicating vulnerable glob matching or IPC setup"
        date = "2024-01-05"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-46171"
        cvss = "6.8"
    strings:
        $glob_func = "glob_match" ascii wide nocase
        $scope_allow = "allowlist" ascii wide nocase
        $scope_deny = "denylist" ascii wide nocase
        $ipc_cmd = "readFile" ascii wide nocase // illustrative; actual names may differ
        $ipc_cmd2 = "writeFile" ascii wide nocase
        $path_sep = "\\\\" ascii wide
        $dot_path = ".*" ascii wide // wildcard usage string
    condition:
        // Focus on binaries with filesystem scope and IPC code
        (uint16(0) == 0x5A4D and filesize < 200MB) and
        (1 of ($ipc_cmd*)) and
        (2 of ($glob_func, $scope_allow, $scope_deny))
}

Note: YARA rule targets binary strings; adjust for packers.

Suricata IDS Rule

# CVE-2022-46171 - Tauri Path Traversal via Filesystem Scope Bypass (network-side)
# Detection limited: This CVE is primarily local filesystem; network detection targets exfiltration after compromise.
alert http any any -> any any (msg:"Tauri CVE-2022-46171 - Potential Exfiltration of Local File Data"; flow:established,to_server; content:".hidden"; http.request_uri; nocase; sid:202246171; rev:1;)

Note: Since the flaw is local, network detection is limited to post-exploitation exfiltration. The rule above flags HTTP requests containing dot-directory references; refine based on app telemetry.

Elastic Detection

// EQL rule to detect file access anomalies from Tauri-processes (Windows example)
file where process.name : "MyApp.exe" and
  ( file.path : "*\\..\\*" or file.path : "*\\.*\\*" ) and
  not file.path : "*\\AppData\\Local\\Temp\\*" // exclude common temp

Note: Replace "MyApp.exe" with the actual executable name from your environment.

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4663
| search ObjectName IN ("*\\..\\*", "*\\.*\\*") AND ProcessName="*MyApp*"
| stats count min(_time) as first_seen max(_time) as last_seen by User, ObjectName, ProcessName
| where count > 5

Note: Tune the ProcessName pattern to the actual binary name. Consider also auditing 4688 for process starts with command-line anomalies.

Wazuh OSSEC Rule

<group name="syscheck,">
  <rule id="977495" level="10">
    <if_sid>550</if_sid> <!-- Syscheck file change -->
    <field name="file">\.\.</field>
    <description>Tauri CVE-2022-46171 - File access with path traversal detected</description>
    <group>path_traversal,tauri,</group>
  </rule>
  <rule id="977496" level="6">
    <if_sid>807</if_sid> <!-- File open -->
    <field name="file">\.</field> <!-- dotted directory -->
    <description>Tauri scope bypass - hidden directory access</description>
    <group>tauri,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: LIKELY (3/4) — Two independent sources (CNA and OSV) confirm the fix exists.

Immediate Mitigations (no vendor workarounds exist):

1. Update Tauri: Immediately upgrade to the latest Tauri release (>= 1.x latest patch). For applications on 1.x branches, apply the backported fix from the most recent 1.x release.
2. Review Scope Definitions: While waiting for the patch, audit your Tauri application's filesystem scope definitions. If possible, explicitly enumerate exact file paths instead of using wildcard patterns like * or ?. Prefer ** if subdirectory recursion is required, though ** is also broad — consider splitting scopes into fine-grained entries.
3. Restrict Frontend Input: If a compromised frontend is a threat, enforce Content Security Policy (CSP) to reduce XSS risk, and validate all frontend-provided paths in the Rust backend (defense-in-depth).

Patch/Upgrade Steps:

• Confirm your Tauri version. Run cargo tree | grep tauri in the application's Rust project to check the dependency version.
• Upgrade tauri and tauri-utils crates to the latest fixed version. For 1.x users, update to the specific 1.x patch release published after the advisory date (the exact version string was not published; consult the GitHub release pages).
• Rebuild and re-sign the application binaries.

Long-Term Hardening:

• Principle of Least Privilege: Minimize filesystem scope to only the directories the application truly needs. Avoid broad roots like $HOME or $APPDATA as the base for scopes.
• Use Exact Paths: Where possible, declare allowlisted file paths (e.g., $APPDATA/myapp/config.toml) rather than patterns.
• Verify on Each Release: Add a test suite that fuzzes the filesystem scope with path traversal sequences (e.g., .., .hidden) before every release.
• Monitor Filesystem Telemetry: Implement the detection rules above to alert on anomalous path access.

References

1. NVD Entry: CVE-2022-46171 — Official NVD record with CNA description and CVSS 6.8.
2. GitHub Security Advisory: [Tauri repository] — The vendor advisory and patch commit; referenced by CNA (OSV package hashes: 13c2fc1ffe93163ec5ab0521fffe936e4f2b8077, 3ceed62686b92b3ab0bcaa00446e107b8cb4646b, 2e1bd04775c0f05f1c0b67605e6abec4465dbf84).
3. CVE.org: CVE-2022-46171 — CNA record from Tauri.
4. Tauri Security Advisory Blog: No public research blog has been released at the time of writing; the vendor maintains a security page for release notes.
5. CISA KEV: Not listed — no known exploitation in the wild per CISA KEV as of 2024.

Known Threat Actor Campaigns: None reported. EPSS score of 0.01006 (59.9th percentile) indicates low current exploitation likelihood. No exploit code or PoC has been publicly published.