Junglewise Threat Intelligence

CVE-2023-46115: Tauri updater private key leakage via Vite environment variables

CVE-2023-46115 · Severity: low · CVSS 3.1 · Published 2023-10-20

Vendors: Tauri.

Executive brief

Tauri, a framework for building desktop applications, previously provided documentation that recommended an insecure configuration when using the Vite build tool. This configuration could cause sensitive information, such as private keys used to sign application updates, to be accidentally included in the application's public code. If these keys are leaked, an attacker could potentially distribute malicious updates to users' computers.

Technical details

A misconfiguration in the Vite `envPrefix` setting, previously suggested in Tauri's official documentation, can lead to the exposure of sensitive environment variables. Specifically, setting `envPrefix: ['VITE_', 'TAURI_']` causes Vite to bundle any environment variable starting with `TAURI_` into the frontend source code. This includes `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD`, which are used for signing application updates. While primarily affecting debug builds, these values could be statically replaced in production builds if referenced. The vulnerability is a result of insecure documentation rather than a bug in the Tauri core. Users are advised to update their `vite.config.ts` to use a safer prefix and rotate their signing keys.

Affected products

  • Tauri tauri-cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16
  • Tauri @tauri-apps/cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16

Timeline

  • 2023-10-19: advisory: Initial disclosure and advisory publication
  • 2023-10-20: disclosed: CVE-2023-46115 assigned

References