OS Command Injection in Rust Programming Language - CVE-2024-24576

Vulnerability identifier: #VU88366

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-24576

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper validation of arguments passed to the std::process::Command when invoking batch files (with the bat and cmd extensions) on Windows using the Command API. A remote attacker can trick the victim to run a specially crafted file and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Rust Programming Language
fd
Anolis OS
Fedora
rustfmt
rust-toolset
rust-std-static-wasm32-wasi
rust-std-static-wasm32-unknown-unknown
rust-srpm-macros
rust-src
rust-lldb
rust-gdb
rust-debugger-common
rust-std-static-x86_64-unknown-uefi
rust-std-static-x86_64-unknown-none
rust-std-static
rust-doc
rust-analyzer
rust
clippy
cargo

Install updates from vendor's website.

Rust Programming Language - update to 1.77.2
fd - update to 10.0.0
rustfmt - update to 1.77.2-1
rust-toolset - update to 1.77.2-1
rust-std-static-wasm32-wasi - update to 1.77.2-1
rust-std-static-wasm32-unknown-unknown - update to 1.77.2-1
rust-srpm-macros - update to 1.77.2-1
rust-src - update to 1.77.2-1
rust-lldb - update to 1.77.2-1
rust-gdb - update to 1.77.2-1
rust-debugger-common - update to 1.77.2-1
rust-std-static-x86_64-unknown-uefi - update to 1.77.2-1
rust-std-static-x86_64-unknown-none - update to 1.77.2-1
rust-std-static - update to 1.77.2-1
rust-doc - update to 1.77.2-1
rust-analyzer - update to 1.77.2-1
rust - update to 1.77.2-1
clippy - update to 1.77.2-1
cargo - update to 1.77.2-1
rust - addressed in versions 1.77.2-1.fc38, 1.77.2-1.fc39, 1.77.2-1.fc40, 1.77.2-1.fc41

• Exploit #9732 - CVE-2024-24576-PoC-Python (April 19, 2024)
• Exploit #9721 - CVE-2024-24576-Exploit (April 19, 2024)

• https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh
• https://github.com/rust-lang/rust/releases/tag/1.77.2

• OS command injection in Rust
• Fedora 41 update for rust
• Fedora 40 update for rust
• Fedora 39 update for rust
• Fedora 38 update for rust
• OS Command Injection in fd
• Anolis OS update for rust