0x0Critical Rust flaw enables Windows command injection attacks
colonialOof. Looks like this affected some other languages as well - somebody at Microsoft needs to up their documentation game, methinks.
BatBadBut: You can't securely execute commands on Windows
Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc. Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied. Today, affected vendors published advisories of these vulnerabilities , so I’m documenting the details here to provide more information about the vulnerabilities and minimize the confusion regarding the high CVSS score. TL;DR The BatBadBut is a vulnerability that allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
This hurts my brain. We have nice shell languages now, can we just lock down and phase out the rest please? I don’t even want to know the hidden cost of running Bash or sh scripts tbh. Both are languages where you can do something not right enough, because everything just has to be obnoxious.
Gobbel2000I won’t argue with you that bash is janky and easily insecure, but what shell language do you think should replace bash?
The only semi-realistic way I can see Bash becoming mostly obsolete is with a tool that provides automated migration of large scripts, and the only project I know of that’s even attempting that is Oil: www.oilshell.org
But for spawning a command in a subprocess, there really ought to be a standard OS API that doesn’t involve invoking a shell at all. I expect that most or all implementations of posix_spawn and execve don’t invoke a shell, but the standard call to start a process on Windows, CreateProcess, apparently does involve cmd.exe for some bizarre reason, and that’s why this is a problem in the first place.