Remote Origin iFrame Vulnerability in Tauri Framework
CVE-2024-35222
Currently unrated
What is CVE-2024-35222?
The Tauri framework faces a vulnerability where remote origin iFrames can gain unauthorized access to Tauri IPC endpoints. This flaw allows an attacker to potentially execute valid but harmful commands such as 'delete project' or 'transfer credits', if they manage to control the content of an iframe integrated within a Tauri application. The issue arises when the applications do not explicitly permit iFrame access through the dangerousRemoteDomainIpcAccess setting in version 1, or the capabilities feature in version 2. Users are encouraged to upgrade to the patched versions 1.6.7 or 2.0.0-beta.19 to mitigate this security risk.