CVE-2024-51745
📋 TL;DR
This vulnerability in Wasmtime's Windows filesystem sandbox allows untrusted WebAssembly programs to bypass device access restrictions by using superscript digits in special device filenames (e.g., COM¹ instead of COM1). Attackers could access peripheral devices like printers, modems, or network resources. Only Windows users running affected Wasmtime versions are impacted.
💻 Affected Systems
- Wasmtime
📦 What is this software?
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
Wasmtime by Bytecodealliance
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through device access leading to data exfiltration, ransomware deployment via printers, or lateral movement through network-connected peripherals.
Likely Case
Unauthorized access to serial/parallel devices, potentially enabling data interception, printer manipulation, or denial of service on connected hardware.
If Mitigated
Limited impact if sandboxing is properly configured with minimal device access, though bypass remains possible for any filesystem directory access.
🎯 Exploit Status
Exploitation requires untrusted Wasm programs with filesystem access. The bypass technique is straightforward once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.0.2, 25.0.3, or 26.0.1
Vendor Advisory: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-c2f5-jxjv-2hh8
Restart Required: Yes
Instructions:
1. Identify current Wasmtime version. 2. Upgrade to 24.0.2, 25.0.3, or 26.0.1 using your package manager or direct download. 3. Restart any services using Wasmtime.
🔧 Temporary Workarounds
No known workarounds
allThe vendor advisory states there are no known workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict filesystem access for untrusted Wasm programs to minimal required directories
- Monitor for unusual device access attempts from Wasmtime processes
🔍 How to Verify
Check if Vulnerable:
Check if Wasmtime version is below 24.0.2, 25.0.3, or 26.0.1 on Windows systems.Check Version:
wasmtime --versionVerify Fix Applied:
Confirm Wasmtime version is 24.0.2, 25.0.3, or 26.0.1 or higher.📡 Detection & Monitoring
Log Indicators:
- Failed or successful device access attempts using superscript digits in filenames
- Unusual Wasmtime process behavior accessing COM/LPT devices
Network Indicators:
- Unexpected network traffic to printers or serial devices from Wasmtime hosts
SIEM Query:
ProcessName="wasmtime" AND (FileName="COM*" OR FileName="LPT*")