CVE-2023-46115: Tauri updater private key leakage via Vite environment variables

CVE-2023-46115 · Severity: low · CVSS 3.1 · Published 2023-10-20

Tauri, a framework for building desktop applications, previously provided documentation that recommended an insecure configuration when using the Vite build tool. This configuration could cause sensitive information, such as private keys used to sign application updates, to be accidentally included in the application's public code. If these keys are leaked, an attacker could potentially distribute malicious updates to users' computers.

Vendors: Tauri.

Quick answers

Is CVE-2023-46115 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-46115 being exploited in the wild.
How severe is CVE-2023-46115?
Low severity, with a CVSS score of 3.1, published 20 October 2023.
Which products and versions are affected?
Tauri tauri-cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16; Tauri @tauri-apps/cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16.
Is there a fix for CVE-2023-46115?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-46115 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2023-46115?
Check whether you run Tauri CLI (Node.js). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A misconfiguration in the Vite `envPrefix` setting, previously suggested in Tauri's official documentation, can lead to the exposure of sensitive environment variables. Specifically, setting `envPrefix: ['VITE_', 'TAURI_']` causes Vite to bundle any environment variable starting with `TAURI_` into the frontend source code. This includes `TAURI_PRIVATE_KEY` and `TAURI_KEY_PASSWORD`, which are used for signing application updates. While primarily affecting debug builds, these values could be statically replaced in production builds if referenced. The vulnerability is a result of insecure documentation rather than a bug in the Tauri core. Users are advised to update their `vite.config.ts` to use a safer prefix and rotate their signing keys.

Affected products

  • Tauri tauri-cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16
  • Tauri @tauri-apps/cli >= 1.0.0, < 1.5.6; >= 2.0.0-alpha.0, < 2.0.0-alpha.16

Identifiers

  • CVE-2023-46115
  • GHSA-2rcp-jvr4-r259

Timeline

  • 2023-10-19: advisory: Initial disclosure and advisory publication
  • 2023-10-20: disclosed: CVE-2023-46115 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.