Command Injection Vulnerability in process Package
Summary
CVE-2024-3566: process: command injection via argument list on Windows. Affects process versions >= 1.0.0.0, < 1.6.23.0. Fixed in 1.6.23.0. How to fix ↓
Also tracked for
The same CVE-2024-3566 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The process package is a widely used library in the Haskell ecosystem that provides functionality for executing external processes. It includes the RawCommand constructor for specifying an executable and its arguments. On Windows, the RawCommand arguments are serialized into a command line string and passed to the CreateProcess routine. However, this serialization process does not properly escape characters with special meaning to cmd.exe, leading to a command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in the process package on Windows allows an attacker to execute arbitrary commands by manipulating the arguments passed to batch files (.bat, .cmd). When a program running on Windows executes a batch file and includes or influences the argument values based on program input, an attacker can inject malicious commands. This can lead to unauthorized access, data exfiltration, or remote code execution.
How To Fix
Minimum fixed version
1.6.23.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The command injection vulnerability in the process package on Windows can be mitigated by updating to version 1.16.19.0 or newer. It is important to ensure that batch files executed with influenced arguments are properly validated to prevent command injection. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for process →
FAQ
The command injection vulnerability allows an attacker to execute arbitrary commands, potentially leading to unauthorized access, data exfiltration, or remote code execution.
The vulnerability affects process versions from 1.0.0.0 to 1.16.18.0.
There is no known exploit available at the moment, but the vulnerability has been publicly disclosed.
If updating the process package is not feasible, it is recommended to avoid executing batch files with arguments influenced by untrusted program inputs. Additionally, rejecting arguments that include special characters like '&' and '"' can help mitigate the risk.
You can find more information about this vulnerability in the official security advisory: [link to the advisory]
