Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-24576— Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows

Quick assessment

Affected
rust-lang rust
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Rust是美国Mozilla基金会的一款通用、编译型编程语言。 Rust 1.77.2之前版本存在安全漏洞，该漏洞源于没有正确转义Windows上批处理文件的参数，攻击者可以通过绕过转义来执行任意shell命令。

CVSS 10.0 · Critical EPSS 20.34% · P97

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-24576

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
Source: CVE Program / CVE List V5
Vulnerability Description
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe to pass untrusted input as an argument. On Windows, the implementation of this is more complex than other platforms, because the Windows API only provides a single string containing all the arguments to the spawned process, and it's up to the spawned process to split them. Most programs use the standard C run-time argv, which in practice results in a mostly consistent way arguments are splitted. One exception though is `cmd.exe` (used among other things to execute batch files), which has its own argument splitting logic. That forces the standard library to implement custom escaping for arguments passed to batch files. Unfortunately it was reported that our escaping logic was not thorough enough, and it was possible to pass malicious arguments that would result in arbitrary shell execution. Due to the complexity of `cmd.exe`, we didn't identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code, and changed the `Command` API to return an `InvalidInput` error when it cannot safely escape an argument. This error will be emitted when spawning the process. The fix is included in Rust 1.77.2. Note that the new escaping logic for batch files errs on the conservative side, and could reject valid arguments. Those who implement the escaping themselves or only handle trusted inputs on Windows can also use the `CommandExt::raw_arg` method to bypass the standard library's escaping logic.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Rust 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Rust是美国Mozilla基金会的一款通用、编译型编程语言。 Rust 1.77.2之前版本存在安全漏洞，该漏洞源于没有正确转义Windows上批处理文件的参数，攻击者可以通过绕过转义来执行任意shell命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
rust-lang rust < 1.77.2 -

II. Public POCs for CVE-2024-24576

# POC Description Source Link Shenlong Link
1 Example of CVE-2024-24576 use case. https://github.com/frostb1ten/CVE-2024-24576-PoC POC Details
2 None https://github.com/brains93/CVE-2024-24576-PoC-Python POC Details
3 CVE-2024-24576 Proof of Concept https://github.com/aydinnyunus/CVE-2024-24576-Exploit POC Details
4 CVE-2024-24576 PoC for Nim Lang https://github.com/foxoman/CVE-2024-24576-PoC---Nim POC Details
5 This is a simple demo for the BadBatBut vulnerability CVE-2024-24576 https://github.com/corysabol/batbadbut-demo POC Details
6 https://nvd.nist.gov/vuln/detail/CVE-2024-24576 https://github.com/mishalhossin/CVE-2024-24576-PoC-Python POC Details
7 CVE-2024-24576 PoC in Julia https://github.com/lpn/CVE-2024-24576.jl POC Details
8 None https://github.com/Gaurav1020/CVE-2024-24576-PoC-Rust POC Details
9 PoC for CVE-2024-24576 vulnerability "BatBadBut" https://github.com/SheL3G/CVE-2024-24576-PoC-BatBadBut POC Details
10 a python proof of concept for cve-2024-24576 https://github.com/p14t1num/cve-2024-24576-python POC Details
11 https://nvd.nist.gov/vuln/detail/CVE-2024-24576 https://github.com/mishl-dev/CVE-2024-24576-PoC-Python POC Details
12 Example of CVE-2024-24576 use case. https://github.com/nasa-frostb1te/CVE-2024-24576-PoC POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-24576

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-24576 (1)

Mailing List Discussions for CVE-2024-24576 (4)

Vendor Pages for CVE-2024-24576 (1)

Other References for CVE-2024-24576 (6)

IV. Related Vulnerabilities

Same product: rust
Same vendor: rust-lang
Same weakness: CWE-78

V. Comments for CVE-2024-24576

No comments yet

Leave a comment