Rust Standard Library CVE-2024-24576 Command Injection Vulnerability Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - The Rust standard library, when using and APIs on Windows, does not properly escape arguments for batch files (with and extensions). - Attackers can control parameters passed to child processes, allowing them to execute arbitrary shell commands by bypassing escaping. 2. Vulnerability Severity: - The severity is "critical" if batch files are invoked on Windows with untrusted parameters. - Other platforms or use cases are unaffected. 3. Vulnerability Identification: - The vulnerability is identified by CVE-2024-24576. 4. Overview: - The and APIs are documented to pass arguments to child processes verbatim, regardless of content, and are not evaluated by the shell. - On Windows, since Windows APIs only provide a single string containing all arguments, the child process must parse them itself. 5. Mitigation: - Due to the complexity of , no safe escaping method for all parameters was found. - The escaping code has been improved in robustness, and it now returns an error when parameters cannot be safely escaped. - The fix will be included in Rust 1.77.2, to be released later today. 6. Affected Versions: - All Rust versions running on Windows prior to 1.77.2 are affected, if the code or dependencies execute batch files with untrusted parameters. - Other platforms or other uses on Windows are unaffected. 7. Acknowledgments: - Thanks to RyotaK and Simon Sawicki (Grub4K) for reporting the vulnerability, and to Rust project contributors including Chris Denton, Mara Bos, Pietro Albini, Manish Goregaokar, Josh Stone, and Amanieu d'Antras. This information provides a detailed description of the vulnerability, its scope of impact, and mitigation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Rust Standard Library CVE-2024-24576 Command Injection Vulnerability Advisory