CVE-2024-24576— Rust 安全漏洞
一分钟漏洞结论
影响对象
rust-lang rust
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Rust是美国Mozilla基金会的一款通用、编译型编程语言。 Rust 1.77.2之前版本存在安全漏洞，该漏洞源于没有正确转义Windows上批处理文件的参数，攻击者可以通过绕过转义来执行任意shell命令。
可能的 ATT&CK 技术 1 AI
T1059 · Command and Scripting Interpreter
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2024-24576 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
来源: CVE Program / CVE List V5
Vulnerability Description
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected.
The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument.
On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted.
One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution.
Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process.
The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
来源: CVE Program / CVE List V5
Vulnerability Title
Rust 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Rust是美国Mozilla基金会的一款通用、编译型编程语言。 Rust 1.77.2之前版本存在安全漏洞，该漏洞源于没有正确转义Windows上批处理文件的参数，攻击者可以通过绕过转义来执行任意shell命令。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2024-24576 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | Example of CVE-2024-24576 use case. | https://github.com/frostb1ten/CVE-2024-24576-PoC | POC详情 |
| 2 | None | https://github.com/brains93/CVE-2024-24576-PoC-Python | POC详情 |
| 3 | CVE-2024-24576 Proof of Concept | https://github.com/aydinnyunus/CVE-2024-24576-Exploit | POC详情 |
| 4 | CVE-2024-24576 PoC for Nim Lang | https://github.com/foxoman/CVE-2024-24576-PoC---Nim | POC详情 |
| 5 | This is a simple demo for the BadBatBut vulnerability CVE-2024-24576 | https://github.com/corysabol/batbadbut-demo | POC详情 |
| 6 | https://nvd.nist.gov/vuln/detail/CVE-2024-24576 | https://github.com/mishalhossin/CVE-2024-24576-PoC-Python | POC详情 |
| 7 | CVE-2024-24576 PoC in Julia | https://github.com/lpn/CVE-2024-24576.jl | POC详情 |
| 8 | None | https://github.com/Gaurav1020/CVE-2024-24576-PoC-Rust | POC详情 |
| 9 | PoC for CVE-2024-24576 vulnerability "BatBadBut" | https://github.com/SheL3G/CVE-2024-24576-PoC-BatBadBut | POC详情 |
| 10 | a python proof of concept for cve-2024-24576 | https://github.com/p14t1num/cve-2024-24576-python | POC详情 |
| 11 | https://nvd.nist.gov/vuln/detail/CVE-2024-24576 | https://github.com/mishl-dev/CVE-2024-24576-PoC-Python | POC详情 |
| 12 | Example of CVE-2024-24576 use case. | https://github.com/nasa-frostb1te/CVE-2024-24576-PoC | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2024-24576 的情报信息
请登录查看更多情报信息。
CVE-2024-24576 厂商安全公告 (1)
-
https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh x_refsource_CONFIRM
CVE-2024-24576 邮件列表归档 (4)
CVE-2024-24576 厂商页面 (1)
-
Security policy - Rust Programming Language x_refsource_MISC
CVE-2024-24576 其他参考 (6)
-
https://github.com/rust-lang/rust/issues x_refsource_MISC
-
https://doc.rust-lang.org/std/process/struct.Command.html x_refsource_MISC
-
https://doc.rust-lang.org/std/process/struct.Command.html#method.arg x_refsource_MISC
IV. Related Vulnerabilities
Same product: rust
V. Comments for CVE-2024-24576
暂无评论