Skip to main content

CreateProcess (Windows) CVE-2024-3566

CRITICAL
Command Injection (CWE-77)
2024-04-10 cret@cert.org
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionNVD

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

AnalysisAI

Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PHP, Rust, Haskell process library, yt-dlp) that wrap the API without compensating for its quirks. Remote attackers can smuggle additional commands through arguments passed to child processes when applications spawn batch files or otherwise rely on CreateProcess's implicit cmd.exe handling. Publicly available exploit code exists and EPSS of 7.09% (92nd percentile) signals elevated, though not confirmed in-the-wild, exploitation interest; this CVE is not listed in CISA KEV.

Technical ContextAI

The flaw (CWE-77, Improper Neutralization of Special Elements used in a Command) stems from how Windows' CreateProcess API parses command-line arguments, particularly when invoking .bat/.cmd files which are silently dispatched via cmd.exe. Language standard libraries and ecosystem tools historically escaped arguments assuming a single, consistent parser, but cmd.exe applies its own metacharacter rules (caret, quotes, ampersand, pipe), allowing crafted arguments to break out of quoting and inject additional commands. Affected CPEs span the Haskell process library, multiple Node.js branches, multiple PHP branches, Rust standard library, and yt-dlp - all of which expose subprocess-spawning APIs that downstream applications use to pass user input to external programs on Windows.

RemediationAI

Upgrade to the patched release for each affected runtime: Node.js, PHP, Rust, the Haskell process library, and yt-dlp each issued coordinated fixes - consult the respective project security advisories linked from the NVD entry for the exact patched version applicable to your branch. Where immediate patching is not possible, compensating controls include refusing to invoke .bat/.cmd files from subprocess APIs (call the underlying executable directly, side-stepping cmd.exe), strictly allow-listing argument characters before passing them to spawn/exec functions, or running Windows workloads on alternative shells via explicit cmd.exe invocation with manual escaping - note that disallowing batch files may break legitimate workflows that depend on .bat wrappers, and character allow-listing risks rejecting valid input such as filenames with spaces or special characters.

Share

CVE-2024-3566 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy