A critical security flaw within the standard library of the Rust programming language has been discovered.<\/p>\n
It allows attackers to exploit a command injection vulnerability on Windows.<\/p>\n
This concerns Rust\u2019s ability to allow programs to run command-line utilities with options passed as arguments to the command.<\/p>\n
Rust\u2019s library for executing command-line programs does not properly escape arguments.<\/p>\n
This could enable attackers to run arbitrary commands by passing specifically crafted arguments.<\/p>\n
Therefore, unauthenticated attackers could execute any program on a machine without user interaction \u2014 with very little complexity.<\/p>\n
Microsoft-owned version management system GitHub has given critical severity status to this vulnerability with a maximum CVSS base score<\/a><\/strong> of 10\/10.<\/p>\n \u201cThe severity of this vulnerability is critical if you are invoking batch files on Windows with untrusted arguments. No other platform or use is affected,\u201d The Rust Security Response Working Group said in a blog post<\/a><\/strong>.<\/p>\n \u201cDue to the complexity of cmd.exe, we didn’t identify a solution that would correctly escape arguments in all cases. To maintain our API guarantees, we improved the robustness of the escaping code and changed the Command API to return an InvalidInput error when it cannot safely escape an argument.\u201d<\/p>\n An update to the programming language, Rust 1.77.2, will introduce a security patch to the standard library to resolve the issue.<\/p>\n Today, Rust 1.77.2 will be released with a critical security patch to the standard library for those on Windows using the Command API to invoke batch files with untrusted arguments. No other platform or use is affected.<\/p>\n See the announcement for details: https:\/\/t.co\/uaLYGDjc2r<\/a><\/p>\n \u2014 Rust Language (@rustlang) April 9, 2024<\/a><\/p><\/blockquote>\n\n