⚠ A critical vulnerability in the Rust standard library prior to version 1.77.2 has been uncovered recently this week, exposing Windows systems to the risk of arbitrary code execution. Our next #CVEOfTheWeek, tracked as CVE-2024-24576, goes to this flaw, which could potentially be exploited by attackers to gain unauthorized control of a system.
This vulnerability has been categorized as critical and has a CVSS score of 10/10. ❌
Exploitation let attackers to:
▶ Run arbitrary code on the vulnerable machine
▶Install malware
▶Steal sensitive data
▶Launch further attacks on the network
💣 The Command::arg and Command::args APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument.
However on Windows, the implementation of this is more complex and there is an exception though, which is cmd.exe. It has its own argument splitting logic that forces the standard library to implement custom escaping for arguments passed to batch files.
Currently Rust foundation hasn't identified a solution that would correctly escape arguments in all cases. A temporary change has been implemented to this part of the library: when the Command API cannot safely escape an argument, it returns an InvalidInput error.
All Rust versions before 1.77.2 on Windows are affected, if the code or any dependencies executes batch files with untrusted arguments. Other platforms or other uses on Windows are not affected. 🛡
⚙ Security advisory on Rust blog:
👉 https://lnkd.in/etxnudQY
#WhiteHatSeries #informationsecurity