The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaScript code. When set to true, it replaces the version comparator from "update must be newer" to "update must be different." Because the default permission set grants allow-check to the webview, any XSS in the app frontend can invoke this command and bypass the only anti-rollback protection the updater offers. Combined with another bug, this enables downgrade attacks without even needing to fake a higher version number.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/tauri-apps/plugins-workspace/commit/1308bfa399b962b3977c7671…
reefs@jfrog.com
https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0
reefs@jfrog.com
https://github.com/tauri-apps/tauri
reefs@jfrog.com
https://github.com/tauri-apps/tauri/security/advisories/GHSA-rjc6-5hfg-grp9
reefs@jfrog.com