Critical “BatBadBut” Vulnerability in the Rust Standard Library Allows for Windows Command Injection Attacks

A critical security vulnerability in the Rust standard library dubbed “BatBadBut” has been discovered, primarily affecting Windows systems through command injection attacks. This flaw, tracked as CVE-2024-24576, which was given a CVSS score of 10/10 by GitHub, allows unauthenticated attackers to remotely execute malicious commands on a system without any user interaction, due to weaknesses in how OS commands and arguments are handled. Specifically, the vulnerability occurs when batch files with “.bat” or “.cmd” extensions are invoked through the Command API without proper argument escaping. This issue is confined to Rust versions prior to 1.77.2 on Windows, and no other platforms are impacted. The Rust Security Response working group has addressed the issue by modifying the Command API to improve argument escaping and handle errors more robustly. This vulnerability also affects several other programming languages like Java, Go, and Python, though not all have issued patches. Security recommendations include moving batch files out of accessible directories to prevent unauthorized execution. CTIX analysts urge all developers to identify which of their programming languages are affected and download the latest patch or follow the guidance documentation provided by the maintainers.