{"id":114973,"date":"2024-04-10T14:30:01","date_gmt":"2024-04-10T12:30:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya"},"modified":"2024-04-10T14:30:01","modified_gmt":"2024-04-10T12:30:01","slug":"uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","title":{"rendered":"Zranitelnost BatBadBut, kter\u00e1 se dot\u00fdk\u00e1 standardn\u00edch knihoven r\u016fzn\u00fdch programovac\u00edch jazyk\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Aplikace, kter\u00e9 spou\u0161t\u011bj\u00ed skripty ve form\u00e1tu bat a cmd na platform\u011b Windows pomoc\u00ed standardn\u00edch funkc\u00ed pro spou\u0161t\u011bn\u00ed proces\u016f, jsou n\u00e1chyln\u00e9 k zranitelnosti, kter\u00e1 umo\u017e\u0148uje proveden\u00ed vlastn\u00edho k\u00f3du p\u0159i p\u0159ed\u00e1v\u00e1n\u00ed argument\u016f bez speci\u00e1ln\u00edho \u00faniku speci\u00e1ln\u00edch znak\u016f. Tato zranitelnost byla pojmenov\u00e1na BatBadBut a projevuje se v aplikac\u00edch vyu\u017e\u00edvaj\u00edc\u00edch standardn\u00ed knihovny jazyk\u016f jako Rust, PHP, Node.js, Python, Ruby, Go, Erlang a Haskell. <\/p>\n

Probl\u00e9m byl ozna\u010den jako zranitelnost, proto\u017ee se dot\u00fdk\u00e1 funkc\u00ed knihovny, jako jsou Command::arg a Command::args v Rust, kter\u00e9 jsou navr\u017eeny pro p\u0159\u00edm\u00e9 p\u0159ed\u00e1v\u00e1n\u00ed argument\u016f procesu bez jejich zpracov\u00e1n\u00ed p\u0159\u00edkazov\u00fdm interpretem. P\u0159edpokl\u00e1d\u00e1 se, \u017ee v\u00fdvoj\u00e1\u0159 aplikace nemus\u00ed kontrolovat argumenty, proto\u017ee jsou p\u0159ed\u00e1v\u00e1ny p\u0159\u00edmo spou\u0161t\u011bn\u00e9mu procesu. Zat\u00edmco v Unixov\u00fdch syst\u00e9mech jsou argumenty p\u0159ed\u00e1v\u00e1ny procesu jednotliv\u011b v poli, v syst\u00e9mu Windows, p\u0159i pou\u017eit\u00ed API CreateProcess, jsou argumenty form\u00e1tov\u00e1ny jako jeden \u0159et\u011bzec, jeho\u017e anal\u00fdzu prov\u00e1d\u00ed spou\u0161t\u011bn\u00fd proces. <\/p>\n

P\u0159i spu\u0161t\u011bn\u00ed skript\u016f bat a cmd na platform\u011b Windows funkce CreateProcess() implicitn\u011b vy\u017eaduje spustiteln\u00fd soubor cmd.exe, i kdy\u017e ho aplikace p\u0159i vol\u00e1n\u00ed neza\u0159azuje. Program cmd.exe obsahuje slo\u017eitou logiku pro rozd\u011blen\u00ed argument\u016f, aby odd\u011blil vlastn\u00ed argumenty, argumenty spou\u0161t\u011bn\u00e9ho skriptu a argumenty tohoto skriptu. Aby se zabr\u00e1nilo substituci argument\u016f na platform\u011b Windows, pou\u017e\u00edvaj\u00ed se ve standardn\u00edch knihovn\u00e1ch programovac\u00edch jazyk\u016f samostatn\u00e9 zpracovatele pro \u00fanik, kter\u00e9 lze obej\u00edt manipulac\u00ed s dvojit\u00fdmi uvozovkami. <\/p>\n

Nap\u0159\u00edklad v programu, kter\u00fd spou\u0161t\u00ed skript '.\\\/test.bat' s argumentem na z\u00e1klad\u011b \u00fadaj\u016f z\u00edskan\u00fdch od u\u017eivatele, m\u016f\u017ee \u00fato\u010dn\u00edk zadat hodnotu '»&calc.exe', kter\u00e1 se p\u0159i spu\u0161t\u011bn\u00ed skriptu rozvine na \u0159et\u011bzec 'C:\\Windows\\System32\\cmd.exe \\\/c .\\test.bat «»&calc.exe»', co\u017e povede k spu\u0161t\u011bn\u00ed procesu calc.exe. Metoda funguje i p\u0159i neimplicitn\u00edm spu\u0161t\u011bn\u00ed skript\u016f, kdy\u017e se spou\u0161t\u00ed spustiteln\u00fd soubor s n\u00e1zvem 'test' bez uveden\u00ed p\u0159\u00edpony, a v jednom z adres\u00e1\u0159\u016f uveden\u00fdch v prom\u011bnn\u00e9 prost\u0159ed\u00ed PATH se nach\u00e1z\u00ed soubor 'test.bat'. <\/p>\n

Oprava pro zranitelnost (CVE-2024-24576) byla nyn\u00ed vyd\u00e1na pro standardn\u00ed knihovnu jazyka Rust a je sou\u010d\u00e1st\u00ed aktualizace Rust 1.77.2. Aktualizace zam\u011b\u0159en\u00e9 na odstran\u011bn\u00ed zranitelnosti pro Node.js a PHP jsou ve f\u00e1zi p\u0159\u00edpravy (u\u017e byly vyd\u00e1ny tagy 8.2.18 a 8.3.5, ale verze je\u0161t\u011b nebyly ozn\u00e1meny). Projekty Python, Ruby, Go, Erlang a Haskell zat\u00edm omezily sv\u00e9 reakce na zve\u0159ejn\u011bn\u00ed varov\u00e1n\u00ed o zranitelnosti v dokumentaci v p\u0159\u00edpad\u011b nedostate\u010dn\u00e9ho escaped speci\u00e1ln\u00edch znak\u016f. <\/p>\n

Ve verzi Rust 1.77.2 byla do standardn\u00ed knihovny p\u0159id\u00e1na dodate\u010dn\u00e1 kontrola, kter\u00e1 vrac\u00ed chybu, pokud argument spou\u0161t\u011bn\u00e9ho skriptu obsahuje speci\u00e1ln\u00ed znaky, kter\u00e9 nelze bezpe\u010dn\u011b zaru\u010den\u011b escapeovat. Pro v\u00fdvoj\u00e1\u0159e, kte\u0159\u00ed implementuj\u00ed logiku escapeov\u00e1n\u00ed, je k dispozici metoda CommandExt::raw_arg, kter\u00e1 zcela deaktivuje escapeov\u00e1n\u00ed na \u00farovni knihovn\u00edch vol\u00e1n\u00ed. <\/p>\n

P\u0159id\u00e1n\u00ed ochrany komplikuje skute\u010dnost, \u017ee jednoduch\u00e9 escapeov\u00e1n\u00ed dvojit\u00fdch uvozovek nesta\u010d\u00ed, proto\u017ee p\u0159\u00edkazov\u00fd interpretr zpracov\u00e1v\u00e1 a odhaluje prom\u011bnn\u00e9, jako je '%PATH%'. Nap\u0159\u00edklad je mo\u017en\u00e9 vlo\u017eit uvozovku prost\u0159ednictv\u00edm manipulace s prom\u011bnnou prost\u0159ed\u00ed '%CMDCMDLINE%', uveden\u00edm m\u00edsto '‘»&calc.exe’' \u2014 '%CMDCMDLINE:~-1%&calc.exe'.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 bat \u0438 cmd \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0448\u0442\u0430\u0442\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BatBadBut \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0442\u0430\u043a\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432, \u043a\u0430\u043a Rust, PHP, Node.js, Python, Ruby, Go, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114973","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost BatBadBut, zasahuj\u00edc\u00ed do standardn\u00edch knihoven r\u016fzn\u00fdch programovac\u00edch jazyk\u016f | ProHoster","description":"Aplikace, kter\u00e9 spou\u0161t\u011bj\u00ed skripty ve form\u00e1tu bat a cmd na platform\u011b Windows pomoc\u00ed standardn\u00edch funkc\u00ed pro spou\u0161t\u011bn\u00ed proces\u016f, jsou n\u00e1chyln\u00e9 k zranitelnosti, kter\u00e1 umo\u017e\u0148uje proveden\u00ed vlastn\u00edho k\u00f3du p\u0159i p\u0159ed\u00e1n\u00ed p\u0159i spu\u0161t\u011bn\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c BatBadBut, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 bat \u0438 cmd \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0448\u0442\u0430\u0442\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-10T12:30:01+00:00","article:modified_time":"2024-04-10T12:30:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114973","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:58:50","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:58:50","updated":"2026-01-22 21:58:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=114973"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/114973\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=114973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=114973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=114973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}