CVE-2024-24576
📋 TL;DR
This critical vulnerability in Rust's standard library allows arbitrary command execution when spawning batch files on Windows with untrusted arguments. Attackers can bypass argument escaping in Command::arg and Command::args APIs to execute shell commands. Only affects Windows systems running Rust programs that invoke batch files with user-controlled arguments.
💻 Affected Systems
- Rust programming language standard library
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Rust by Rust Lang
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, allowing attackers to execute arbitrary commands with the privileges of the Rust process.
Likely Case
Privilege escalation or lateral movement within Windows environments where Rust applications process untrusted input for batch file execution.
If Mitigated
No impact if applications don't invoke batch files on Windows or only use trusted arguments.
🎯 Exploit Status
Exploitation requires control over arguments passed to batch file execution. Public disclosure includes technical details enabling weaponization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Rust 1.77.2
Vendor Advisory: http://www.openwall.com/lists/oss-security/2024/04/09/16
Restart Required: No
Instructions:
1. Update Rust toolchain to version 1.77.2 or later using rustup update. 2. Recompile all Rust applications with the updated toolchain. 3. Redeploy patched applications.
🔧 Temporary Workarounds
Use CommandExt::raw_arg for trusted inputs
windowsBypass standard library escaping for trusted arguments only using the raw_arg method
use std::os::windows::process::CommandExt;
command.raw_arg("trusted_argument");
Avoid batch file execution with untrusted arguments
windowsModify applications to not invoke batch files with user-controlled input
🧯 If You Can't Patch
- Implement input validation and sanitization for all arguments passed to batch file execution
- Use alternative execution methods that don't rely on Command API for batch files, or implement custom secure escaping
🔍 How to Verify
Check if Vulnerable:
Check Rust version with rustc --version and verify it's below 1.77.2. Review code for Command::arg/args usage with batch files on Windows.Check Version:
rustc --versionVerify Fix Applied:
Confirm rustc --version shows 1.77.2 or higher. Test that batch file execution with malicious arguments now returns InvalidInput error.📡 Detection & Monitoring
Log Indicators:
- Unexpected cmd.exe or batch file execution from Rust processes
- InvalidInput errors from Command API on Windows
Network Indicators:
- Unusual outbound connections from Rust applications following batch execution
SIEM Query:
Process creation where parent_process contains 'rust' and (process_name contains 'cmd.exe' OR command_line contains '.bat' OR command_line contains '.cmd')🔗 References
- http://www.openwall.com/lists/oss-security/2024/04/09/16
- https://doc.rust-lang.org/std/io/enum.ErrorKind.html#variant.InvalidInput
- https://doc.rust-lang.org/std/os/windows/process/trait.CommandExt.html#tymethod.raw_arg
- https://doc.rust-lang.org/std/process/struct.Command.html
- https://doc.rust-lang.org/std/process/struct.Command.html#method.arg
- https://doc.rust-lang.org/std/process/struct.Command.html#method.args
- https://github.com/rust-lang/rust/issues
- https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N323QAEEUVTJ354BTVQ7UB6LYXUX2BCL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPH3PF7DVSS2LVIRLW254VWUPVKJN46P/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7WRFOIAZXYUPGXGR5UEEW7VTTOD4SZ3/
- https://www.rust-lang.org/policies/security
- http://www.openwall.com/lists/oss-security/2024/04/09/16
- https://doc.rust-lang.org/std/io/enum.ErrorKind.html#variant.InvalidInput
- https://doc.rust-lang.org/std/os/windows/process/trait.CommandExt.html#tymethod.raw_arg
- https://doc.rust-lang.org/std/process/struct.Command.html
- https://doc.rust-lang.org/std/process/struct.Command.html#method.arg
- https://doc.rust-lang.org/std/process/struct.Command.html#method.args
- https://github.com/rust-lang/rust/issues
- https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N323QAEEUVTJ354BTVQ7UB6LYXUX2BCL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RPH3PF7DVSS2LVIRLW254VWUPVKJN46P/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W7WRFOIAZXYUPGXGR5UEEW7VTTOD4SZ3/
- https://www.kb.cert.org/vuls/id/123335
- https://www.rust-lang.org/policies/security
