CVE-2022-46175 PoC — Tauri 安全漏洞

Source

https://github.com/giz-berlin/quasar-app-webpack-json5-vulnerability

Associated Vulnerability

Title:Tauri 安全漏洞 (CVE-2022-46175)
Description:Tauri是Tauri开源的一个使用 Web 前端构建更小、更快、更安全的桌面应用程序。 Tauri 2.2.1版本及之前版本存在安全漏洞，该漏洞源于parse方法不限制名为“__proto__”键的解析，从而允许特制的字符串污染生成对象的原型。

Description

Reproduction for CVE-2022-46175

Readme

# Quasar App (quasar-app-webpack-json5-vulnerability)

A Quasar Project

## Install the dependencies
```bash
yarn
# or
npm install
```

### Start the app in development mode (hot-code reloading, error reporting, etc.)
```bash
quasar dev
```


### Lint the files
```bash
yarn lint
# or
npm run lint
```


### Format the files
```bash
yarn format
# or
npm run format
```



### Build the app for production
```bash
quasar build
```

### Customize the configuration
See [Configuring quasar.config.js](https://v2.quasar.dev/quasar-cli-webpack/quasar-config-js).

File Snapshot


 [4.0K]  /data/pocs/15ca626c068cec7b4ed9bbddc2b10b547590bc02
├── [ 263]  babel.config.js
├── [1.3K]  package.json
├── [4.0K]  public
│   ├── [ 63K]  favicon.ico
│   └── [4.0K]  icons
│       ├── [ 12K]  favicon-128x128.png
│       ├── [ 859]  favicon-16x16.png
│       ├── [2.0K]  favicon-32x32.png
│       └── [9.4K]  favicon-96x96.png
├── [6.9K]  quasar.config.js
├── [ 558]  README.md
├── [4.0K]  src
│   ├── [ 161]  App.vue
│   ├── [4.0K]  assets
│   │   └── [4.4K]  quasar-logo-vertical.svg
│   ├── [4.0K]  boot
│   ├── [4.0K]  components
│   │   ├── [ 754]  EssentialLink.vue
│   │   ├── [1.2K]  ExampleComponent.vue
│   │   └── [ 108]  models.ts
│   ├── [4.0K]  css
│   │   ├── [  31]  app.scss
│   │   └── [ 774]  quasar.variables.scss
│   ├── [ 209]  env.d.ts
│   ├── [ 991]  index.template.html
│   ├── [4.0K]  layouts
│   │   └── [2.2K]  MainLayout.vue
│   ├── [4.0K]  pages
│   │   ├── [ 588]  ErrorNotFound.vue
│   │   └── [ 919]  IndexPage.vue
│   ├── [ 451]  quasar.d.ts
│   ├── [4.0K]  router
│   │   ├── [1.0K]  index.ts
│   │   └── [ 428]  routes.ts
│   └── [ 244]  shims-vue.d.ts
├── [ 101]  tsconfig.json
└── [281K]  yarn.lock

10 directories, 27 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!