Windows Command Escape Vulnerability - Critical CVE ... or is it?

From the creator

Critical! ... or is it? CVE-2024-24576 is a freshly reported 10/10 critical CVE affecting Rust, Python, and many other programming languages on Windows that, if exploited, can allow a malicious user to execute arbitrary code as the current user. The 10/10 rating is the worst severity that can be given to a CVE. However, of 9 affected programming languages, 5 have chosen to either not fix the CVE or fix it only by updating their documentation. Let's take a look at this vulnerability, which appears to take advantage of programming languages improperly escaping arguments while creating sub-processes, understand how it's performed, and see why so many languages are choosing not to fix it. ― mCoding with James Murphy (https://mcoding.io) Source code: https://github.com/mCodingLLC/VideosSampleCode Python discussion: https://discuss.python.org/t/is-python-affected-by-cve-2024-24576/50740/1 NIST CVE details: https://nvd.nist.gov/vuln/detail/CVE-2024-24576 Rust advisory: https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html Subprocess docs: https://docs.python.org/3/library/subprocess.html Subprocess source: https://github.com/python/cpython/blob/main/Lib/subprocess.py CreateProcessW docs: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw Security researcher blog post: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/ SUPPORT ME ⭐ ---------------------------------------------------

Published 2024-04-19 · Watch on YouTube ↗
Availability and playback restrictions are controlled by the original channel.