CreateProcess (Windows) CVE-2024-3566
CRITICALCVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DescriptionNVD
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
AnalysisAI
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.
Technical ContextAI
The flaw (CWE-77, Improper Neutralization of Special Elements used in a Command) stems from how Windows' CreateProcess API parses command-line arguments, particularly when invoking .bat/.cmd files which are silently dispatched via cmd.exe. Language standard libraries and ecosystem tools historically escaped arguments assuming a single, consistent parser, but cmd.exe applies its own metacharacter rules (caret, quotes, ampersand, pipe), allowing crafted arguments to break out of quoting and inject additional commands. Affected CPEs span the Haskell process library, multiple Node.js branches, multiple PHP branches, Rust standard library, and yt-dlp - all of which expose subprocess-spawning APIs that downstream applications use to pass user input to external programs on Windows.
RemediationAI
Upgrade to the patched release for each affected runtime: Node.js, PHP, Rust, the Haskell process library, and yt-dlp each issued coordinated fixes - consult the respective project security advisories linked from the NVD entry for the exact patched version applicable to your branch. Where immediate patching is not possible, compensating controls include refusing to invoke .bat/.cmd files from subprocess APIs (call the underlying executable directly, side-stepping cmd.exe), strictly allow-listing argument characters before passing them to spawn/exec functions, or running Windows workloads on alternative shells via explicit cmd.exe invocation with manual escaping - note that disallowing batch files may break legitimate workflows that depend on .bat wrappers, and character allow-listing risks rejecting valid input such as filenames with spaces or special characters.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today