PT-2024-2720 · Rust+2 · Rust+2
Ry0Tak
·
Published
2024-04-09
·
Updated
2026-01-05
·
CVE-2024-24576
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Rust versions prior to 1.77.2
Description
A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks. The vulnerability allows attackers to execute arbitrary shell commands by bypassing the escaping of arguments when invoking batch files on Windows using the
Command API. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected.The
Command::arg and Command::args APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. However, on Windows, the implementation is more complex due to the Windows API only providing a single string containing all the arguments to the spawned process. The standard library implements custom escaping for arguments passed to batch files, but it was reported that this escaping logic was not thorough enough, allowing malicious arguments to result in arbitrary shell execution.Recommendations
To resolve the issue, update to Rust 1.77.2 or later. If you are using a version prior to 1.77.2, consider disabling the execution of batch files or restricting the use of the
Command API until a patch is available. Additionally, be cautious when passing untrusted input as arguments to the Command API, as this could lead to command injection attacks. If you implement the escaping yourself or only handle trusted inputs on Windows, you can also use the CommandExt::raw arg method to bypass the standard library's escaping logic.Exploit
Fix
OS Command Injection
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Red Os
Rust