CVE-2024-24576
published 2024-09-04CVE-2024-24576: Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows…
PriorityP276critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
20.34%
97.2th percentile
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn't check for that. Affected users who are using Rust 1.77.2 or greater can remove the trailing whitespace (ASCII 0x20) and trailing periods (ASCII 0x2E) from the batch file name to bypass the incomplete fix and enable the mitigations. Users are affected if their code or one of their dependencies invoke a batch script on Windows with trailing whitespace or trailing periods in the name, and pass untrusted arguments to it. Rust 1.81.0 will update the standard library to apply the CVE-2024-24576 mitigations to all batch files invocations, regardless of the trailing chars in the file name.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rustc | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| rust-lang | rust | < 1.81.0 | 1.81.0 |
| rust-lang | rust | < 1.81.0 | 1.81.0 |
| rust-lang | rust | < 1.77.2 | 1.77.2 |
Detection & IOCsextracted from sources · hover to see the quote
- →Flag invocations of batch files (.bat/.cmd) on Windows via Rust's Command API where arguments contain shell metacharacters — this is the core exploitation vector for CVE-2024-24576. ↗
- →Detect bypass of the CVE-2024-24576 fix by monitoring batch file invocations where the filename has trailing whitespace (ASCII 0x20) or trailing periods (ASCII 0x2E), e.g. a file named `.bat. .` being resolved as `.bat` by Windows. ↗
- →Alert on child process spawning of cmd.exe from Rust-based applications on Windows, especially where the command line contains untrusted user-supplied arguments passed to batch files. ↗
- →Monitor for batch file names with trailing whitespace (ASCII 0x20) or trailing periods (ASCII 0x2E) being passed to process-spawning APIs on Windows, as these are the specific bypass patterns for the incomplete fix. ↗
- →Identify Rust binaries on Windows older than version 1.77.2 (for CVE-2024-24576) or older than 1.81.0 (for the incomplete-fix bypass CVE-2024-43402) that invoke batch files with external/untrusted arguments. ↗
- ·The vulnerability is Windows-exclusive; no other platforms are affected. Red Hat Linux targets are explicitly not affected. ↗
- ·The fix in Rust 1.77.2 was incomplete; the full fix requires Rust 1.81.0 to cover batch file names with trailing whitespace or periods. ↗
- ·The new escaping logic introduced in the fix is conservative and may reject valid arguments; operators using CommandExt::raw_arg bypass the escaping entirely and must ensure their own input sanitization. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vendor_debian10.0LOW
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
vendor_redhat·2024-09-04·CVSS 10.0
CVE-2024-43402 [CRITICAL] CWE-78 rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For exam
Red Hat
rust: Fail to Escape Arguments Properly in Microsoft Windows
vendor_redhat·2024-04-09·CVSS 10.0
CVE-2024-24576 [CRITICAL] CWE-78 rust: Fail to Escape Arguments Properly in Microsoft Windows
rust: Fail to Escape Arguments Properly in Microsoft Windows
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected.
The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and
Debian
CVE-2024-24576: rustc - Rust is a programming language. The Rust Security Response WG was notified that ...
vendor_debian·2024·CVSS 10.0
CVE-2024-24576 [CRITICAL] CVE-2024-24576: rustc - Rust is a programming language. The Rust Security Response WG was notified that ...
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`. An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. The severity of this vulnerability is critical for those who invoke batch files on Windows with untrusted arguments. No other platform or use is affected. The `Command::arg` and `Command::args` APIs state in their documentation that the arguments will be passed to the spawned process as-is, regardless of the content of the arguments, and will not be evaluated by a shell. This means it should be safe
Debian
CVE-2024-43402: rustc - Rust is a programming language. The fix for CVE-2024-24576, where `std::process:...
vendor_debian·2024·CVSS 10.0
CVE-2024-43402 [CRITICAL] CVE-2024-43402: rustc - Rust is a programming language. The fix for CVE-2024-24576, where `std::process:...
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn't check for that. Affected users who are usi
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Critical Rust flaw enables Windows command injection attacks
blogs_bleepingcomputer·2024-04-09·CVSS 10.0
CVE-2024-24576 [CRITICAL] Critical Rust flaw enables Windows command injection attacks
## Critical Rust flaw enables Windows command injection attacks
## Sergiu Gatlan
Threat actors can exploit a security vulnerability in the Rust standard library to target Windows systems in command injection attacks.
Tracked as CVE-2024-24576 , this flaw is due to OS command and argument injection weaknesses that can let attackers execute unexpected and potentially malicious commands on the operating system.
GitHub rated this vulnerability as critical severity with a maximum CVSS base score of 10/10. Unauthenticated attackers can exploit it remotely, in low-complexity attacks, and without user interaction.
"The Rust Security Response WG was notified that the Rust standard library did not properly escape arguments when invoking batch files (with the bat and cmd extensions) on Windows u
HackerOne
`std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods
hackerone·2024-11-22·CVSS 10.0
CVE-2024-24576 [CRITICAL] `std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods
`std::process::Command` batch files argument escaping could be bypassed with trailing whitespace or periods
On April 9th, 2024, the Rust Security Response WG disclosed CVE-2024-24576, where std::process::Command incorrectly escaped arguments when invoking batch files on Windows. We were notified that our fix for the vulnerability was incomplete, and it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows).
The severity of the incomplete fix is low, due to the niche conditions needed to trigger it. Note that calculating the CVSS score might assign a higher severity to this, but that doesn't take into account what is required to trigger the incomplete fix.
The incomplete fix is identified by CVE-2024-43402.
Bugzilla
CVE-2024-43402 rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
bugzilla·2024-09-04·CVSS 10.0
CVE-2024-43402 [CRITICAL] CVE-2024-43402 rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
CVE-2024-43402 rust: Rust standard library did not properly escape arguments when invoking batch files on Windows using the Command API
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file
2024-09-04
Published