Applications that execute scripts in bat and cmd format on the Windows platform using standard process launch functions are vulnerable to an exploit that allows arbitrary code execution if arguments are passed at launch without separately escaping special characters. This vulnerability is codenamed BatBadBut and manifests in applications using standard libraries of languages such as Rust, PHP, Node.js, Python, Ruby, Go, Erlang, and Haskell.
The issue is classified as a vulnerability because it affects library functions such as Command::arg and Command::args in Rust, designed for direct argument passing to the process without being processed by a command interpreter. It is implied that the application developer may not validate the arguments, as they are directly passed to the launched process. In Unix systems, arguments are passed to the process separately in an array, whereas in Windows, using the CreateProcess API, arguments are formatted as a single string, with parsing responsibility falling on the launched process.
When launching bat and cmd scripts on the Windows platform, the CreateProcess() function implicitly invokes the executable file cmd.exe, even if the application does not specify it in the call. The cmd.exe program contains its own complex logic for argument splitting to separate its arguments, the arguments of the launched script, and the arguments of that script. To protect against argument substitution on the Windows platform, separate escaping handlers are applied in standard programming language libraries, which can be bypassed through manipulation with double quotes.
For example, in a program calling the script ‘./test.bat’ with an argument based on user-provided data, an attacker can pass the value ‘»&calc.exe’, which when the script is run will expand to the string ‘C:\Windows\System32\cmd.exe /c .\test.bat «»&calc.exe’ leading to the execution of the calc.exe process. This method also works for implicit script launches, where an executable file named ‘test’ is run without specifying an extension, and a ‘test.bat’ file exists in one of the directories mentioned in the PATH environment variable.
A fix has been released (CVE-2024-24576) for the standard library of the Rust language and is included in the Rust 1.77.2 update. Updates addressing the vulnerability for Node.js and PHP are in preparation (tags 8.2.18 and 8.3.5 have already been set, but releases have not yet been announced). The Python, Ruby, Go, Erlang, and Haskell projects have only included a warning in their documentation regarding the manifestation of the vulnerability due to inadequate escaping of special characters.
In Rust 1.77.2, an additional check has been added to the standard library, returning an error if the arguments of the executed script contain special characters that cannot be guaranteed to be safely escaped. For developers implementing their own escaping logic, the CommandExt::raw_arg method is provided, which completely disables escaping on the library call side.
The addition of protection is hindered by the fact that simple escaping of double quotes is insufficient since the command interpreter processes and expands variables such as '%PATH%'. For example, a quote can be injected through manipulation of the '%CMDCMDLINE%' environment variable, specifying '%CMDCMDLINE:~-1%&calc.exe' instead of '"&calc.exe'.
Source: opennet.ru
