Amr Bashir

3 exploits Active since Dec 2022
CVE-2022-46171 WRITEUP MEDIUM WRITEUP
tauri 1.0.0-1.0.8 - Path Traversal via Glob Pattern Wildcards
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
CVSS 6.8
CVE-2022-46171 WRITEUP MEDIUM WRITEUP
tauri 1.0.0-1.0.8 - Path Traversal via Glob Pattern Wildcards
Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literals and leading dots by default, which unintentionally exposes sub folder content of allowed paths. Scopes without the wildcards are not affected. As `**` allows for sub directories the behavior there is also as expected. The issue has been patched in the latest release and was backported into the currently supported 1.x branches. There are no known workarounds at the time of publication.
CVSS 6.8
CVE-2023-34460 WRITEUP MEDIUM WRITEUP
Tauri 1.4.0 - Improper Authorization via Filesystem Scope Check Regression
Tauri is a framework for building binaries for all major desktop platforms. The 1.4.0 release includes a regression on the Filesystem scope check for dotfiles on Unix. Previously dotfiles were not implicitly allowed by the glob wildcard scopes (eg. `$HOME/*`), but a regression was introduced when a configuration option for this behavior was implemented. Only Tauri applications using wildcard scopes in the `fs` endpoint are affected. The regression has been patched on version 1.4.1.
CVSS 4.8