Windowsi platvormil bat- ja cmd-formaadis skripte k\u00e4ivitavad rakendused, mis kasutavad protsesside k\u00e4ivitamise standardfunktsioone, on haavatavad haavatavuse t\u00f5ttu, mis v\u00f5imaldab koodi t\u00e4itmist, kui k\u00e4ivitamisel edastatakse argumente ilma eraldi eraldamiseta erim\u00e4rkidest. See haavatavus on saanud koodinimeks BatBadBut ja see ilmneb rakendustes, mis kasutavad standardseid raamatukogusid sellistes keeltes nagu Rust, PHP, Node.js, Python, Ruby, Go, Erlang ja Haskell. <\/p>\n
Probleem on klassifitseeritud haavatavuseks, kuna see m\u00f5jutab selliste raamatukogude funktsioone nagu Command::arg ja Command::args keeles Rust, mis on m\u00f5eldud argumentide edastamiseks protsessile ilma nende t\u00f6\u00f6tlemiseta k\u00e4surida t\u00f5lgendaja kaudu. Eeldatakse, et rakenduse arendaja ei pruugi argumente kontrollida, kuna need edastatakse otse k\u00e4ivitatavale protsessile. Kui Unix-s\u00fcsteemides edastatakse argumendid protsessile eraldi massiivis, siis Windowsis kutsuvad API CreateProcess argumendid esile \u00fcheainsa stringina, mille parsimine j\u00e4\u00e4b k\u00e4ivitava protsessi kanda. <\/p>\n
Windowsi platvormil bat- ja cmd-skripte k\u00e4ivitades t\u00f5mbab funktsioon CreateProcess() ebamugavalt sisse t\u00e4itmisfaili cmd.exe, isegi kui rakendus ei t\u00e4psusta seda kutse tegemisel. Programm cmd.exe sisaldab enda keerulist argumentide eraldamise loogikat, et eraldada oma argumendid, k\u00e4ivitatava skripti argumendid ja selle skripti argumendid. Windowsi platvormil argumentide asendamise v\u00e4ltimiseks rakendatakse programmeerimiskeelte standardsetes raamatukogudes eraldi eraldusmehhanisme, mida saab \u00fcletada kahekohaliste jutum\u00e4rgid manipuleerimise teel. <\/p>\n
\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0435, \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0449\u0435\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 ‘.\/test.bat’ \u0441 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0434\u0430\u043d\u043d\u044b\u0445, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 ‘»&calc.exe’, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0437\u0432\u0451\u0440\u043d\u0443\u0442\u043e \u0432 \u0441\u0442\u0440\u043e\u043a\u0443 ‘C:\Windows\System32\cmd.exe \/c .\test.bat «»&calc.exe»‘ \u0438 \u043f\u0440\u0438\u0432\u0435\u0434\u0451\u0442 \u043a \u0437\u0430\u043f\u0443\u0441\u043a\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 calc.exe. \u041c\u0435\u0442\u043e\u0434 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0438 \u043f\u0440\u0438 \u043d\u0435\u044f\u0432\u043d\u043e\u043c \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432, \u043a\u043e\u0433\u0434\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441 \u0438\u043c\u0435\u043d\u0435\u043c «test» \u0431\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f, \u0430 \u0432 \u043e\u0434\u043d\u043e\u043c \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432, \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0432 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f PATH, \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0444\u0430\u0439\u043b «test.bat». <\/p>\n
Hetkel on v\u00e4lja antud parandamine (CVE-2024-24576) Rusti standardraamatukogu jaoks, mis on osa Rusti uuendusest 1.77.2. Protsessis on tegemisel v\u00e4rskendused Node.js ja PHP jaoks, mis tegelevad haavatava koha k\u00f5rvaldamisega (sildid 8.2.18 ja 8.3.5 on juba v\u00e4lja m\u00e4\u00e4ratud, kuid v\u00e4ljalaskmisi pole veel kuulutatud). Python, Ruby, Go, Erlang ja Haskell projektid on seni piirdunud dokumentatsioonis hoiatuse lisamisega haavatavuse ilmnemise kohta ilma n\u00f5uetekohase eraldamiseta. <\/p>\n
Rust 1.77.2 on standardraamatukokku lisatud t\u00e4iendav kontroll, mis tagastab vea, kui k\u00e4ivitatava skripti argumendis on erim\u00e4rke, mida ei saa kindlalt ohutult eraldada. Arendajatele, kes rakendavad ise eraldusloogikat, on kergesti k\u00e4tte saadav meetod CommandExt::raw_arg, mis t\u00e4iesti keelab eraldamise raamatukogu kutsete k\u00fcljest. <\/p>\n
\u0414\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u0435\u0448\u0430\u0435\u0442 \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0432\u043e\u0439\u043d\u044b\u0445 \u043a\u0430\u0432\u044b\u0447\u0435\u043a \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e, \u0442\u0430\u043a \u043a\u0430\u043a \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u043f\u0440\u0435\u0442\u0430\u0442\u043e\u0440 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a «%PATH%». \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u0430\u0432\u044b\u0447\u043a\u0443 \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f «%CMDCMDLINE%», \u0443\u043a\u0430\u0437\u0430\u0432 \u0432\u043c\u0435\u0441\u0442\u043e ‘»&calc.exe’ — ‘%CMDCMDLINE:~-1%&calc.exe’. \u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 bat \u0438 cmd \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0448\u0442\u0430\u0442\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BatBadBut \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0442\u0430\u043a\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432, \u043a\u0430\u043a Rust, PHP, Node.js, Python, Ruby, Go, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114973","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus BatBadBut, mis m\u00f5jutab erinevate programmeerimiskeelte standardraamatukogusid | ProHoster","description":"Windowsi platvormil bat- ja cmd-formaadis skripte k\u00e4ivitavad rakendused, mis kasutavad protsesside k\u00e4ivitamise standardfunktsioone, on haavatavad haavatavuse t\u00f5ttu, mis v\u00f5imaldab koodi t\u00e4itmist, kui k\u00e4ivitamisel edastatakse argumente ilma eraldi eraldamiseta erim\u00e4rkidest. See haavatavus on saanud koodinimeks BatBadBut ja see ilmneb rakendustes, mis kasutavad standardseid raamatukogusid sellistes keeltes nagu Rust, PHP, Node.js, Python, Ruby, Go.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c BatBadBut, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f | ProHoster","og:description":"\u041f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0438\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 bat \u0438 cmd \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0448\u0442\u0430\u0442\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0431\u0435\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f BatBadBut \u0438 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 \u0442\u0430\u043a\u0438\u0445 \u044f\u0437\u044b\u043a\u043e\u0432, \u043a\u0430\u043a Rust, PHP, Node.js, Python, Ruby, Go,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-batbadbut-zatragivayushhaya-standartnye-biblioteki-razlichnyh-yazykov-programmirovaniya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-04-10T12:30:01+00:00","article:modified_time":"2024-04-10T12:30:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114973","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 21:58:50","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-22 21:58:50","updated":"2026-01-22 21:58:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=114973"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/114973\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=114973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=114973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=114973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"