Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

CVE-2023-46115

What is CVE-2023-46115?

The Tauri Framework, designed for building cross-platform binaries, is vulnerable due to a misconfiguration when integrating with the Vite frontend. Specifically, the inclusion of a code snippet that uses the 'envPrefix' with both 'VITE_' and 'TAURI_' in the Vite configuration can inadvertently expose sensitive information, namely the private key and updater key password, within the bundled application. This stems from an example in the Tauri documentation, which illustrates insecure practices. Developers are encouraged to adopt safer configurations and are advised to rotate their updater private key if impacted, ensuring a secure application build process.

References