PT-2023-27225 · Rust+4 · Rust+4

Remkop22 · Published 2023-08-24 · Updated 2024-07-29 · CVE-2023-40030

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rust versions 1.60.0 through 1.71

Description The issue arises from Cargo not escaping Cargo feature names when including them in the report generated by cargo build --timings. This allows a malicious package included as a dependency to inject nearly arbitrary HTML, potentially leading to cross-site scripting if the report is subsequently uploaded somewhere. The vulnerability affects users relying on dependencies from git, local paths, or alternative registries. Users who solely depend on crates.io are unaffected. The vulnerability can be exploited by injecting Javascript into the page, for example with a feature name like features = ["<img src='' onerror=alert(0)"]. If this report were subsequently uploaded to a domain that uses credentials, the injected Javascript could access resources from the website visitor.

Recommendations For Rust versions 1.60.0 through 1.71, update to Rust 1.72 or later to fix the issue. As a general precaution, users should exercise care in which package they download, by only including trusted dependencies in their projects.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-6236

ALT-PU-2024-2838

AZL-28511

CVE-2023-40030

GHSA-WRRJ-H57R-VX9P

OPENSUSE-SU-2023_3722-1

OPENSUSE-SU-2024:13262-1

SUSE-SU-2023:3722-1

SUSE-SU-2023_3722-1

Affected Products

Alt Linux

Debian

Red Os

Rust

Suse

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40030.json · Exploit
• 🔥 https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2023-38497 · Exploit
• https://github.com/rust-lang/cargo/commit/9835622853f08be9a4b58ebe29dcec8f43b64b33 · Patch
• https://github.com/rust-lang/cargo/security/advisories/GHSA-wrrj-h57r-vx9p · Vendor Advisory
• https://github.com/rust-lang/cargo/pull/12291 · Patch
• https://github.com/rust-lang/cargo/commit/f975722a0eac934c0722f111f107c4ea2f5c4365 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-40030 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40030 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40030 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2023-40030 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40030 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-40030 · Security Note
• https://osv.dev/vulnerability/GHSA-wrrj-h57r-vx9p · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:3722-1 · Vendor Advisory