Description
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Node.js | Node.js | ≤ 21.7.2 | — |
| Go Programming Language | GoLang | — | — |
| Haskell Programming Language | Haskel | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hackage | process | >= 1.0.0.0, < 1.6.23.0 | 1.6.23.0 | HSEC-2024-0003 |
References
- https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
- https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
- https://kb.cert.org/vuls/id/123335
- https://www.cve.org/CVERecord?id=CVE-2024-24576
- https://www.cve.org/CVERecord?id=CVE-2024-1874
- https://www.cve.org/CVERecord?id=CVE-2024-22423
- https://www.kb.cert.org/vuls/id/123335