Programming

17507 readers

9 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Follow the programming.dev instance rules
Keep content related to programming in some way
If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]

founded 1 year ago

MODERATORS

snowe

Ategon

[email protected]

133

Critical Rust flaw enables Windows command injection attacks (www.bleepingcomputer.com)

submitted 7 months ago by 0x0 to c/programming

35 comments fedilink hide all child comments

you are viewing a single comment's thread
view the rest of the comments

[–] onlinepersona 14 points 7 months ago (2 children)

At least it's not a segfault, buffer overflow, or whatever else plagues C/C++ programs and is not easy to detect.

Anti Commercial AI thingy

CC BY-NC-SA 4.0

[–] [email protected] 24 points 7 months ago (2 children)

But it got a 10/10 on the scoring system by Github.

The issue isn't actually too much related to the Rust core language itself, but rather how they handle scripts on Windows platform. So if you don't have a Windows program that runs Batch scripts, then it doesn't matter to you. I wonder how common it is to run Batch scripts in Rust?

[–] [email protected] 8 points 7 months ago

if you don't have a Windows program that runs Batch scripts with untrusted arguments

This only matters when running the scripts with user inputs passed as arguments to the command, which I can't imagine being remotely common at all.

[–] tatterdemalion 5 points 7 months ago

I don't think my company uses batch scripts anywhere, but if they did, it would probably be in the app installer for Windows or something.

[–] [email protected] 14 points 7 months ago (2 children)

Also, the reason this is a CVE is because Rust itself guarantees that calling commands doesn't evaluate shell stuff (but this breaks that guarantee). As far as I know C/C++ makes no such guarantee whatsoever.

[–] Buttons 8 points 7 months ago

Our bug is their status quo.

[–] [email protected] 6 points 7 months ago (1 children)

C++ has no guarantees built into stdlib but frameworks like Qt provide safe access - the ecosystem has options. C++ itself is quite a simple language, most of the power comes out of toolsets and frameworks built on top of it.

[–] arendjr 1 points 7 months ago (1 children)

What are the chances Qt is affected by this issue too?

[–] [email protected] -1 points 7 months ago (1 children)

Vanishingly small. In Qt that'd have to be an issue in QStringList IIRC.

[–] arendjr 3 points 7 months ago* (last edited 7 months ago)

That’s certainly not the case, because that’s like saying the issue is with Rust’s string slices. I think you may have missed the part of the issue where batch scripts require additional escaping due to Windows’ command handling. It’s a ridiculous design of the Windows API system, which is also why (almost?) every language they tested was vulnerable, so it would be actually very outstanding if Qt prevented this.

For C++ devs not using Qt it’s just another footgun they’ll likely keep introducing security issues with as well. But if you do use Qt, I think it’s better to double-check since it may also require a patch.