CVE-2023-46115

Executive Summary

CVE-2023-46115 is a security misconfiguration issue affecting Tauri applications that use the Vite frontend framework in a specific, documented configuration. The vulnerability stems from an insecure example in the official Tauri documentation that instructs developers to set envPrefix: ['VITE_', 'TAURI_'] in their vite.config.ts file, which causes the TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD environment variables to be bundled directly into the frontend JavaScript code shipped with the application. Any Tauri application built with this configuration leaks the updater private key and its password to anyone who inspects the released application bundle, enabling attackers to forge signed updates and potentially compromise affected systems. The issue carries a CVSS score of 8.4 and affects any Tauri project that copied the insecure documentation example, regardless of version. Mitigation requires rotating updater keys and correcting the configuration.

Technical Analysis

This advisory describes a configuration-induced information disclosure rather than a bug in the Tauri codebase itself. The mechanism functions through Vite's envPrefix configuration option, which determines which environment variables from the build environment are eligible for exposure to client-side code. Vite's default behavior exposes variables prefixed with VITE_ to the frontend bundle. The insecure example in the official Tauri Vite guide instructs developers to append TAURI_ to the prefix list, as shown: envPrefix: ['VITE_', 'TAURI_'],.

This configuration has a direct and dangerous consequence. Tauri's CLI relies on the TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD environment variables at build time to sign the application bundle for secure update delivery. When TAURI_ is added to envPrefix, Vite's bundler scans all environment variables available at build time, matches those sharing the configured prefixes, and inlines them as literal string constants in the generated frontend JavaScript. Because the build environment contains TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD (they are required to sign the bundle), these highly sensitive values get embedded into static JavaScript files within the application's resources directory.

The resulting attack surface is the compiled application binary. Desktop applications can be trivially unpacked — Tauri applications are essentially web content wrapped in a native webview shell. The .js bundle files within the application resources can be searched for strings beginning with recognizable patterns. The private key, typically an RSA private key in PEM or base64-encoded form, and the password string are present in plaintext. An attacker who extracts these values gains the ability to sign malicious update payloads that the Tauri updater will accept as legitimate.

The vulnerability is triggered at build time and manifests at distribution time. The affected configuration is not checked or rejected by either Vite or Tauri's build tooling in versions prior to 1.5.5 of the Tauri CLI. Notably, this only affects projects using Vite with the specific documented example. The advisory explicitly confirms that using envPrefix: ['VITE_'] alone, or any frontend framework other than Vite, means the project is not impacted.

Exploitation Scenarios

The attack chain for CVE-2023-46115 unfolds across the software supply chain lifecycle.

Step 1 — Reconnaissance / Target Identification: The attacker's first step is identifying Tauri applications that may be vulnerable. Since the vulnerable configuration is static JavaScript content, the attacker can obtain a legitimate copy of a target Tauri application and search the unpacked resources for the presence of the leaked key material. No special access is required — the application is publicly distributed. Tools such as curl, the Chrome DevTools Protocol, or simple string extraction utilities can be used to retrieve and scan the JavaScript bundles. Evidence of the leak includes base64-encoded RSA private key blocks (-----BEGIN RSA PRIVATE KEY----- or base64 DER representations) appearing in frontend code, which should never contain key material.

Step 2 — Triggering the Flaw: The vulnerability is triggered at build time by the developer, not at runtime by the attacker. The developer who copied the documentation example into vite.config.ts and then builds the application with TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD set in the environment causes the secrets to be baked into the frontend bundle. The attacker does not need to "trigger" anything at runtime — the extraction is passive. The attacker simply reads the static application files.

Step 3 — Payload/Execution Method: The attacker extracts the leaked private key and password from the application's JavaScript bundle. With these credentials, the attacker can now sign arbitrary update payloads for the targeted application. The Tauri updater, when checking for updates, verifies the signature of the update archive against the public key embedded in tauri.conf.json in the application. Because the attacker possesses the matching private key, the signature check passes. The attacker then hosts a malicious update payload on a server they control and either waits for the updater to discover it (if the update endpoint is attacker-controlled) or uses social engineering to trick the user into installing a malicious update.

Step 4 — Post-Exploitation Impact: Successful exploitation grants the attacker the ability to push fully signed, valid update payloads to all users of the affected application. This is a code execution primitive with trusted status. The attacker can replace the application with malware that runs in the context of the legitimate application, including any elevated privileges or trusted credentials the application holds. This can lead to complete system compromise, data exfiltration, or lateral movement within the user's network. Note that the updater private key is per-application; the attacker's reach is limited to the one application for which the key was leaked.

No public proof-of-concept or exploit code has been observed for CVE-2023-46115 per the data provided. The attack chain above is inferred from the vulnerability class (insufficiently protected credentials exposed to client-side code) and the advisory's description.

Impact Assessment

The business impact of CVE-2023-46115 is severe for affected Tauri application vendors. The CVSS base score of 8.4 places this in the "high" severity band, reflecting the full confidentiality loss of the updater signing key and the integrity/availability impact on the update delivery chain.

• Confidentiality Impact (C:High): The private signing key and its password are fully exposed to anyone who downloads the application. There is no technical barrier to extraction.
• Integrity Impact (I:Low): The attacker can forge signed updates, violating the integrity of the update channel.
• Availability Impact (A:Low): By pushing malicious or deliberately broken updates, the attacker can render the application unusable across the installed base.
• Attack Vector (AV:Network): The leak is present in the distributed application, accessible over the network by download.
• Attack Complexity (AC:Low): Extracting the credentials from a JavaScript bundle requires trivial effort and standard tooling.

Affected Systems: All Tauri desktop applications built with Vite that used the documented insecure configuration snippet. This is independent of the Tauri version. The Tauri CLI version 1.5.5 adds detection capabilities but does not fix already-built applications.

Blast Radius: The blast radius is limited to individual applications — each leaked key only compromises that application's update channel. However, for a widely deployed enterprise application, the impact scales to full remote code execution on thousands of endpoints.

EPSS Consideration: The EPSS score of 0.00192 (9.1% percentile) indicates low observed exploitation prevalence. However, this low score may reflect a lack of detection rather than lack of abuse — key extraction from JavaScript bundles is silent and may go unnoticed for a long period.

Detection Guidance

Sigma Rule

title: Tauri Updater Private Key Leakage via Vite Frontend
id: c9a4ff1e-57b2-4b21-8e54-5a7d69e0c8b3
status: experimental
description: Detects Tauri application builds where TAURI_PRIVATE_KEY or TAURI_KEY_PASSWORD appear in frontend JavaScript bundles, indicating insecure envPrefix configuration
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46115
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
    category: process_creation
    product: windows
detection:
    selection_vite:
        CommandLine|contains:
            - 'vite build'
            - 'tauri build'
    selection_leak:
        # Detection at build output inspection level
        CommandLine|contains:
            - 'TAURI_PRIVATE_KEY'
            - 'TAURI_KEY_PASSWORD'
    condition: selection_vite and selection_leak
falsepositives:
    - Build scripts that deliberately echo env vars for debugging
level: high

YARA Rule

rule Tauri_Private_Key_Leak
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects leaked Tauri updater private key material in frontend JavaScript bundles"
        cve = "CVE-2023-46115"
        date = "2024-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-46115"
    strings:
        $rsa_pem = "-----BEGIN RSA PRIVATE KEY-----" ascii fullword
        $pem_generic = "-----BEGIN PRIVATE KEY-----" ascii fullword
        $tauri_updater_env = "TAURI_PRIVATE_KEY" ascii fullword
        $key_password_env = "TAURI_KEY_PASSWORD" ascii fullword
        $updater_cfg = "updater" ascii fullword
        $vite_prefix = "envPrefix" ascii fullword
    condition:
        filesize < 10MB and
        (
            2 of ($pem*) and
            (
                $tauri_updater_env or $key_password_env
            )
        ) or
        (
            $vite_prefix and $tauri_updater_env
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-46115 Tauri Updater Private Key Leaked in JS Bundle"; flow:established,to_client; file_data; content:"TAURI_PRIVATE_KEY"; nocase; content:"BEGIN RSA PRIVATE KEY"; nocase; distance:0; within:60000; classtype:attempted-user; sid:10000001; rev:1; metadata:cve CVE-2023-46115;)

Elastic Detection

// Detect web responses containing leaked Tauri updater credentials
sequence by source.ip with maxspan=10s
  [ network where event.type == "connection" and network.protocol == "http" ]
  [ http where event.category == "web" and
      http.response.bytes > 10000 and
      wildcard(http.response.body, "*TAURI_PRIVATE_KEY*") and
      (wildcard(http.response.body, "*BEGIN RSA PRIVATE KEY*") or
       wildcard(http.response.body, "*BEGIN PRIVATE KEY*"))
  ]

Splunk SPL Query

index=web OR index=proxy sourcetype=stream:http
| search "TAURI_PRIVATE_KEY" OR "TAURI_KEY_PASSWORD"
| search "BEGIN RSA PRIVATE KEY" OR "BEGIN PRIVATE KEY"
| eval body_length = len(payload)
| where body_length > 10000
| eval verdict = "CVE-2023-46115_LEAK_DETECTED"
| table _time, src_ip, dest_ip, uri, http_method, status, body_length, verdict

Wazuh OSSEC Rule

<group name="tauri-secrets,">
  <rule id="100461" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.js$</field>
    <match>TAURI_PRIVATE_KEY|TAURI_KEY_PASSWORD</match>
    <description>CVE-2023-46115: Tauri updater private key or password detected in JavaScript bundle</description>
    <group>cve-2023-46115,tauri-leak,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official vendor patch exists for this issue because it is a configuration-flaw in documentation, not a code defect in the Tauri framework. The data provided indicates no patch evidence from any tracked source.

Immediate Mitigations (apply this week):

1. Rotate the updater private key. Assume any application built with the insecure configuration has been compromised. Generate a new key with tauri signer generate and update the pubkey value in tauri.conf.json with the new public key.
2. Update your Tauri CLI to version 1.5.5 or newer. The CLI now includes detection logic that warns or errors when the insecure configuration is detected, preventing future accidental leaks.
3. Correct the vite.config.ts configuration. Change envPrefix: ['VITE_', 'TAURI_'] to envPrefix: ['VITE_']. This is a one-line change.
4. Release a forced migration update. Sign the next application build with the OLD (compromised) private key so that existing installations accept the update; this update should contain the NEW public key and rotate the key on client devices.

Patch/Upgrade Steps:

1. Upgrade @tauri-apps/cli to >=1.5.5.
2. Review all build configurations across the organization for Vite envPrefix settings containing TAURI_.
3. Verify no other frontend framework configurations expose environment variables with a TAURI_ prefix.
4. Run a string-scan against every released application artifact to confirm no residual key material exists in deployed bundles.
5. Coordinate the key rotation with the forced update release to minimize the window where attackers could forge updates.

Long-Term Hardening:

1. Maintain a policy that no environment variable has a prefix overlapping with frontend-exposed prefixes. Tauri automatically exposes VITE_-prefixed vars to the Vite bundle; keep all secret-env vars on a separate prefix not included in envPrefix.
2. Add a CI/CD security check that scans built artifacts for TAURI_PRIVATE_KEY and TAURI_KEY_PASSWORD string patterns and fails the pipeline on detection.
3. Implement a secrets-management solution (e.g., vault-injected build secrets) that prevents secrets from remaining in the build environment where bundlers can capture them.
4. Regularly audit the official Tauri documentation for insecure example updates, and subscribe to the Tauri security advisory RSS feed.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-46115 — Official NVD record with CVSS score 8.4, EPSS data, and advisory reference.
2. Tauri Security Advisory (CNA): Via GitHub Security Advisory — original advisory describing the insecure envPrefix documentation example and the key-rotation procedure.
3. Tauri GitHub Repository (tauri-apps/tauri): Release notes for tauri-cli v1.5.5 documenting the detection capability for the insecure envPrefix configuration.
4. Tauri Official Documentation — Vite Guide: The guide containing the insecure envPrefix: ['VITE_', 'TAURI_'] example; developers should monitor it for correction.
5. CISA KEV Catalog: No entry — CVE-2023-46115 is not on the Known Exploited Vulnerabilities list as of the report date, consistent with the EPSS percentile of 9.1% indicating low observed exploitation.

Threat Actor Activity: No known threat-actor campaigns specifically leveraging CVE-2023-46115 were identified in the provided data. However, the silent nature of key extraction from static bundles means existing exploitation may go undetected. Access to the update channel of a popular Tauri application would be a high-value target for APT-style supply-chain operations, and organizations using Tauri in production should treat this advisory with elevated urgency despite the low EPSS percentile.