GitHub Security Advisory: GHSA-57fm-592m-34r7
Package: tauri (RUST)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 2.0.0-beta.0, < 2.0.0-beta.20
Patched in: 2.0.0-beta.20

Summary: iFrames Bypass Origin Checks for Tauri API Access Control

Details:
## Impact

Remote origin iFrames in Tauri applications can access the Tauri IPC endpoints without being explicitly allowed in the [`dangerousRemoteDomainIpcAccess`](https://v1.tauri.app/api/config/#securityconfig.dangerousremotedomainipcaccess) in v1 and in the [`capabilities`](https://v2.tauri.app/security/capabilities/#remote-api-access) in v2.
This bypasses the origin check and allows iFrames to access the IPC endpoints exposed to the parent window.

For this to be exploitable, an attacker must have script execution (e.g. XSS) in a script-enabled iFrame of a Tauri application.

## Patches

The patches include changes to wry and the behaviour of Tauri applications using iFrames. Previously, we injected the Tauri IPC initialization script into iFrames on MacOS, which was unintended. This is now also disabled to be consistent with all other supported operating systems.

This means that the Tauri invoke functionality is no longer accessible from iFrames, except on Windows when the origin of the Tauri window and the origin of the iFrame are the same.

We have also added a new protection mechanism to the IPC layer to protect against iFrames directly using the WebView IPC functionality (e.g. via `window.ipc.postMessage`).
This introduces an invoke key (`__TAURI_INVOKE_KEY__`) which is used to prevent frames that have not been initialized by the Tauri core from sending messages to the Tauri IPC.
This key is **not** used to protect against compromised Tauri windows or WebViews and is **only** intended to block IPC access from sub-frames.

Unauthorized messages to the Tauri IPC from an iFrame or other non-initialized context will log a warning and the potentially malicious IPC call will be ignored.

## Workarounds

These workarounds should only be considered if you are unable to upgrade to the patched Tauri version in time.

As a workaround for v1 Tauri applications, we recommend using a dedicated window for untrusted origins instead of iFrames, or disabling script execution within the iFrame.

For v2 Tauri applications targeting Linux, it is possible to use either a dedicated window or [multiple WebViews](https://github.com/tauri-apps/tauri/tree/dev/examples/multiwebview) in the main window to simulate iFrame behavior.
On other platforms, it is only possible to use dedicated windows or disable script execution inside the iFrame, as described for v1.

## References

If you have any questions or comments about this advisory:

Open an issue in tauri or
Email us at [security@tauri.app](mailto:security@tauri.app)

The original submissions from the reporter:

> ### Context
> 
> This is following up on the comments here: https://github.com/tauri-apps/tauri/issues/8316, and here: https://discord.com/channels/[PII_REDACTED]90023171/[PII_REDACTED]91966475. I was asked to submit my findings as a vulnerability report.
> 
> Firstly, thank you to all of you from the core team that helped out and guided me through understanding this issue! Huge fan of Tauri, and I'm excited