CVE-2024-35222 - CVE House
Back to Database
Status published Medium CVE-2024-35222

iFrames Bypass Origin Checks for Tauri API Access Control

Vulnerability Description

Tauri is a framework for building binaries for all major desktop platforms. Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the `dangerousRemoteDomainIpcAccess` in v1 and in the `capabilities` in v2. Valid commands with potentially unwanted consequences ("delete project", "transfer credits", etc.) could be invoked by an attacker that controls the content of an iframe running inside a Tauri app. This vulnerability has been patched in versions 1.6.7 and 2.0.0-beta.19.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-35222

Credits & Attribution

No credits recorded in the NVD database.

References

More from tauri-apps

View All →
CVE-2025-31477
Improper Scope Validation in the open Endpoint of tauri-plugin-shell
Critical 9.3
CVE-2023-46115
Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli
High 8.4
CVE-2023-34460
Tauri vulnerable to Regression on Filesystem Scope Checks for Dotfiles
Medium 4.8
CVE-2023-31134
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites
Medium 4.8
CVE-2022-46171
Tauri vulnerable to path traversal
Medium 6.8

Affected Vendor

Affected Software

tauri
Vulnerable Versions:
<= 1.6.6, >= 2.0.0-beta.0, <= 2.0.0-beta.19

Timeline

Official Publish: May 23rd, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact