The Rust CVE-2024-24576 vulnerability lets hackers access your system

Cybercriminals discovered how to exploit the critical security vulnerability (CVE-2024-24576) in the Rust standard library. Through it, they can threaten Windows systems with injection attacks. Cybercriminals can use this technique to execute malicious programs on your device.

In addition, according to the Common Vulnerability Scoring System (CVSS), this issue with the Rust standard library is critical. After all, hackers don’t need you to interact with their malware to exploit it remotely with low-complexity attacks.

What does the critical security vulnerability (CVE-2024-24576) mean?

According to the Rust security team, the critical security vulnerability (CVE-2024-24576) means the Rust standard library can’t handle special characters used in batch arguments. So, when Rust programs execute the Command API to use batch files, wrongdoers can control arguments and find a way in. Afterward, they can run malicious commands on your system.

The CVE-2024-24576 vulnerability doesn’t affect other operating systems or Rust programs that don’t use batch files. Additionally, the flaw is present only in Rust versions before 1.77.2.

The Rust security team had a challenge patching the vulnerability due to the complexity of the cmd.exe. So, they couldn’t escape all the arguments. However, they found a way around it by modifying the Command API. After the update, if the API can’t escape an argument, it will return an InvalidInput error.

If you need to bypass the standard escaping, use the CommandExt::raw_arg method. It will allow you to handle trusted inputs or to make your escape.

Even if there are a few critical security vulnerabilities like (CVE-2024-24576), the White House Office of the National Cyber Director (ONCD) considers that tech companies should use memory-safe languages like Rust. After all, they minimize the memory-safe vulnerabilities hackers use to execute malicious codes. On top of that, they cause crashes and data corruption.

Ultimately, to fix the critical security vulnerability (CVE-2024-24576) of the Rust storage library, upgrade it to 1.77.2. In this way, you will prevent threat actors from exploiting it. Thus, they won’t be able to use special arguments to execute malicious commands.

What are your thoughts? Do you use Rust applications? Let us know in the comments.