ID:9732 - Exploit for OS Command Injection in Rust Programming Language - CVE-2024-24576

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper validation of arguments passed to the std::process::Command when invoking batch files (with the bat and cmd extensions) on Windows using the Command API. A remote attacker can trick the victim to run a specially crafted file and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation