{"id":114973,"date":"2024-04-10T14:30:01","date_gmt":"2024-04-10T12:30:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya"},"modified":"2024-04-10T14:30:01","modified_gmt":"2024-04-10T12:30:01","slug":"uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","title":{"rendered":"The BatBadBut vulnerability affecting standard libraries of various programming languages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Applications that execute scripts in bat and cmd format on the Windows platform using standard process launch functions are vulnerable to an exploit that allows arbitrary code execution if arguments are passed at launch without separately escaping special characters. This vulnerability is codenamed BatBadBut and manifests in applications using standard libraries of languages such as Rust, PHP, Node.js, Python, Ruby, Go, Erlang, and Haskell. <\/p>\n
The issue is classified as a vulnerability because it affects library functions such as Command::arg and Command::args in Rust, designed for direct argument passing to the process without being processed by a command interpreter. It is implied that the application developer may not validate the arguments, as they are directly passed to the launched process. In Unix systems, arguments are passed to the process separately in an array, whereas in Windows, using the CreateProcess API, arguments are formatted as a single string, with parsing responsibility falling on the launched process. <\/p>\n
When launching bat and cmd scripts on the Windows platform, the CreateProcess() function implicitly invokes the executable file cmd.exe, even if the application does not specify it in the call. The cmd.exe program contains its own complex logic for argument splitting to separate its arguments, the arguments of the launched script, and the arguments of that script. To protect against argument substitution on the Windows platform, separate escaping handlers are applied in standard programming language libraries, which can be bypassed through manipulation with double quotes. <\/p>\n
For example, in a program calling the script \u2018.\/test.bat\u2019 with an argument based on user input data, an attacker can pass the value \u2018\u00bb&calc.exe\u2019, which when the script runs will expand to the string \u2018C:\\Windows\\System32\\cmd.exe \/c .\/test.bat \u00ab\u00bb&calc.exe\u2019 and will lead to the execution of the calc.exe process. This method works even with implicit script execution when an executable file named \u2018test\u2019 is run without specifying an extension, as long as a file named \u2018test.bat\u2019 exists in one of the directories listed in the PATH environment variable. <\/p>\n
A fix has been released (CVE-2024-24576) for the standard library of the Rust language and is included in the Rust 1.77.2 update. Updates addressing the vulnerability for Node.js and PHP are in preparation (tags 8.2.18 and 8.3.5 have already been set, but releases have not yet been announced). The Python, Ruby, Go, Erlang, and Haskell projects have only included a warning in their documentation regarding the manifestation of the vulnerability due to inadequate escaping of special characters. <\/p>\n
In Rust 1.77.2, an additional check has been added to the standard library, returning an error if the arguments of the executed script contain special characters that cannot be guaranteed to be safely escaped. For developers implementing their own escaping logic, the CommandExt::raw_arg method is provided, which completely disables escaping on the library call side. <\/p>\n
Adding protection is complicated since simply escaping double quotes is not enough, as the command interpreter processes and reveals variables like \u2018%PATH%\u2019. For instance, a quote can be injected by manipulating the environment variable \u2018%CMDCMDLINE%\u2019, specifying instead of \u2018\u00bb&calc.exe\u2019 \u2014 \u2018%CMDCMDLINE:~-1%&calc.exe\u2019. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"