[CVSS Score 10.0] Windows' Latest "BatBadBut" Critical Rust Vulnerability

Recently, a critical vulnerability in the Rust standard library could be exploited to target Windows systems and execute command injection attacks.

The vulnerability was discovered by RyotaK, a security engineer from Flatt Security. They named it BatBadBut and published an analysis report on April 9, 2024.

On the same day, GitHub registered it as CVE-2024-24576, with a severity rating (CVSS) of 10.0.

▌Decoding the BatBadBut Vulnerability

BatBadBut is a vulnerability that allows attackers to perform command injection against Windows applications that indirectly depend on the "CreateProcess" function under certain conditions.

RyotaK explained: "CreateProcess() implicitly spawns cmd.exe when executing batch files (.bat, .cmd, etc.), even if the application did not specify them in the command line. The problem is that cmd.exe has complex parsing rules for command arguments, and programming language runtimes fail to escape command arguments properly."

According to the researcher, because of this, if someone can control the command argument part of the batch file, they can inject commands.

In an advisory released on April 9, the Rust Security Response WG stated that they had been notified that the Rust standard library did not properly escape arguments when invoking batch files (with bat and cmd extensions) using the Command API on Windows.

The advisory reads: "An attacker who can control the arguments passed to the spawned process can execute arbitrary shell commands by bypassing the escaping."

▌High CVSS, Low Risk?

The severity of BatBadBut received the highest score of 10.0.

However, RyotaK stated in their post that the real-world exploitability of the vulnerability might be lower than initially feared.

First, a successful exploitation of BatBadBut only occurs when the following conditions are met:

• The application executes a command on Windows

• The application does not specify the file extension of the command, or the file extension is .bat or .cmd

• The command being executed contains user-controlled input as part of the command arguments

• The programming language runtime fails to properly escape command arguments for cmd.exe

Furthermore, BatBadBut only affects Rust versions prior to 1.77.2 – other platforms or usages are not affected.

The high CVSS score is based on how libraries are attributed.

"The CVSS v3.1 User Guide states that the CVSS score for a library should be calculated based on the worst-case scenario, which is why vulnerabilities in programming languages have recently received high scores despite requiring specific conditions," RyotaK explained.

The security researcher recommended recalculating the CVSS score based on the "Forum of Incident Response and Security Teams (FIRST) implementation guidance for software libraries."

Although this vulnerability can only be exploited under certain conditions, organisations must still remain vigilant and verify as soon as possible whether their defence systems can withstand related attacks. Attack simulation rules targeting this vulnerability exploit have been added to the Nextcloud Security Validation Platform. You can search for the keyword "rust-lang standard library" in the Nextcloud Security Validation Platform to obtain relevant attack simulation validation actions, thereby verifying whether your security defence system can effectively deal with the exploitation of this vulnerability. The platform ensures that your validation process is safe and harmless in an industry-unique manner.