CVE-2024-3566 (GCVE-0-2024-3566)

Vulnerability from cvelistv5 – Published: 2024-04-10 15:22 – Updated: 2025-11-18 17:35

Title

Command injection vulnerability in programing languages on Microsoft Windows operating system.

Summary

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

certcc

References

8 references

URL	Tags
https://flatt.tech/research/posts/batbadbut-you-c…
https://learn.microsoft.com/en-us/archive/blogs/t…
https://kb.cert.org/vuls/id/123335
https://www.cve.org/CVERecord?id=CVE-2024-24576
https://www.cve.org/CVERecord?id=CVE-2024-1874
https://www.cve.org/CVERecord?id=CVE-2024-22423
https://www.kb.cert.org/vuls/id/123335
https://github.com/nu11secur1ty/Windows11Exploits…

Impacted products

8 products

Vendor	Product	Version
Node.js	Node.js	Affected: * , ≤ 21.7.2 (custom)
Go Programming Language	GoLang	Affected: *
Haskell Programming Language	Haskel	Affected: *
nodejs	nodejs	Affected: 0 , ≤ 21.7.2 (custom) cpe:2.3:a:nodejs:nodejs::::::::
haskell	process_library	Affected: 0 , < 1.6.19.0 (custom) cpe:2.3:a:haskell:process_library::::::::
rust-lang	rust	Affected: 0 , < 1.77.2 (custom) cpe:2.3:a:rust-lang:rust::::::::
thephpgroup	thephpgroup	Affected: 0 , < * (custom) cpe:2.3:a:thephpgroup:thephpgroup::::::::
yt-dlp_project	yt-dlp	Affected: 0 , < * (custom) cpe:2.3:a:yt-dlp_project:yt-dlp:-:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-18T17:35:41.547Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.cert.org/vuls/id/123335"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nodejs",
            "vendor": "nodejs",
            "versions": [
              {
                "lessThanOrEqual": "21.7.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "process_library",
            "vendor": "haskell",
            "versions": [
              {
                "lessThan": "1.6.19.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rust",
            "vendor": "rust-lang",
            "versions": [
              {
                "lessThan": "1.77.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:thephpgroup:thephpgroup:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "thephpgroup",
            "vendor": "thephpgroup",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:yt-dlp_project:yt-dlp:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "yt-dlp",
            "vendor": "yt-dlp_project",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-3566",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-15T16:13:02.290928Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-22T18:25:43.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Windows"
          ],
          "product": "Node.js",
          "vendor": "Node.js",
          "versions": [
            {
              "lessThanOrEqual": "21.7.2",
              "status": "affected",
              "version": "*",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "GoLang",
          "vendor": "Go Programming Language",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        },
        {
          "platforms": [
            "Windows"
          ],
          "product": "Haskel",
          "vendor": "Haskell Programming Language",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-10T15:26:52.009Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
        },
        {
          "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
        },
        {
          "url": "https://kb.cert.org/vuls/id/123335"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
        },
        {
          "url": "https://www.kb.cert.org/vuls/id/123335"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command injection vulnerability in programing languages on Microsoft Windows operating system.",
      "x_generator": {
        "engine": "VINCE 2.1.12",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-3566"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2024-3566",
    "datePublished": "2024-04-10T15:22:56.099Z",
    "dateReserved": "2024-04-10T04:58:27.982Z",
    "dateUpdated": "2025-11-18T17:35:41.547Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-3566",
      "date": "2026-06-05",
      "epss": "0.09605",
      "percentile": "0.93035"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-3566\",\"sourceIdentifier\":\"cret@cert.org\",\"published\":\"2024-04-10T16:15:16.083\",\"lastModified\":\"2026-05-15T15:03:11.680\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad de inyecci\u00f3n de comandos permite a un atacante realizar inyecci\u00f3n de comandos en aplicaciones de Windows que dependen indirectamente de la funci\u00f3n CreateProcess cuando se cumplen las condiciones espec\u00edficas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.6.19.0\",\"matchCriteriaId\":\"838E7C22-2203-42B8-B8DE-52306C0053CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"18.20.2\",\"matchCriteriaId\":\"22F26905-4C5D-431E-955A-F2A35FA25401\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"19.0.0\",\"versionEndExcluding\":\"20.12.2\",\"matchCriteriaId\":\"F5CD069C-89BE-43CD-B741-0B976DCC5D2A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"21.0.0\",\"versionEndExcluding\":\"21.7.3\",\"matchCriteriaId\":\"43547541-B480-439B-B18C-8FE493599E6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"8.1.28\",\"matchCriteriaId\":\"FF638A38-6375-40D9-95A8-1013E3B630F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2.0\",\"versionEndExcluding\":\"8.2.18\",\"matchCriteriaId\":\"6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0\",\"versionEndExcluding\":\"8.3.6\",\"matchCriteriaId\":\"E88C969D-88C3-46A2-96AB-A3F63E814F24\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.77.2\",\"matchCriteriaId\":\"C49FDBA9-6417-4761-9CF1-1EF8E70B782C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2021.04.11\",\"versionEndExcluding\":\"2024.04.09\",\"matchCriteriaId\":\"2C6B8E2D-693F-494C-BE61-CF52780035AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2572D17-1DE6-457B-99CC-64AFD54487EA\"}]}]}],\"references\":[{\"url\":\"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/\",\"source\":\"cret@cert.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://kb.cert.org/vuls/id/123335\",\"source\":\"cret@cert.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way\",\"source\":\"cret@cert.org\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-1874\",\"source\":\"cret@cert.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-22423\",\"source\":\"cret@cert.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-24576\",\"source\":\"cret@cert.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/123335\",\"source\":\"cret@cert.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://kb.cert.org/vuls/id/123335\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Technical Description\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-1874\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-22423\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.cve.org/CVERecord?id=CVE-2024-24576\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/123335\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Not Applicable\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566\"}, {\"url\": \"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://kb.cert.org/vuls/id/123335\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-24576\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-1874\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-22423\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.kb.cert.org/vuls/id/123335\", \"tags\": [\"x_transferred\"]}], \"x_generator\": {\"engine\": \"ADPogram 0.0.1\"}, \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-18T17:35:41.547Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-3566\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-15T16:13:02.290928Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:nodejs:nodejs:*:*:*:*:*:*:*:*\"], \"vendor\": \"nodejs\", \"product\": \"nodejs\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"21.7.2\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*\"], \"vendor\": \"haskell\", \"product\": \"process_library\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.6.19.0\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*\"], \"vendor\": \"rust-lang\", \"product\": \"rust\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.77.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:thephpgroup:thephpgroup:*:*:*:*:*:*:*:*\"], \"vendor\": \"thephpgroup\", \"product\": \"thephpgroup\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:yt-dlp_project:yt-dlp:-:*:*:*:*:*:*:*\"], \"vendor\": \"yt-dlp_project\", \"product\": \"yt-dlp\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-22T18:25:36.997Z\"}}], \"cna\": {\"title\": \"Command injection vulnerability in programing languages on Microsoft Windows operating system.\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Node.js\", \"product\": \"Node.js\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"21.7.2\"}], \"platforms\": [\"Windows\"]}, {\"vendor\": \"Go Programming Language\", \"product\": \"GoLang\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\"}], \"platforms\": [\"Windows\"]}, {\"vendor\": \"Haskell Programming Language\", \"product\": \"Haskel\", \"versions\": [{\"status\": \"affected\", \"version\": \"*\"}], \"platforms\": [\"Windows\"]}], \"references\": [{\"url\": \"https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/\"}, {\"url\": \"https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way\"}, {\"url\": \"https://kb.cert.org/vuls/id/123335\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-24576\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-1874\"}, {\"url\": \"https://www.cve.org/CVERecord?id=CVE-2024-22423\"}, {\"url\": \"https://www.kb.cert.org/vuls/id/123335\"}], \"x_generator\": {\"env\": \"prod\", \"engine\": \"VINCE 2.1.12\", \"origin\": \"https://cveawg.mitre.org/api/cve/CVE-2024-3566\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"shortName\": \"certcc\", \"dateUpdated\": \"2024-04-10T15:26:52.009Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-3566\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-18T17:35:41.547Z\", \"dateReserved\": \"2024-04-10T04:58:27.982Z\", \"assignerOrgId\": \"37e5125f-f79b-445b-8fad-9564f167944b\", \"datePublished\": \"2024-04-10T15:22:56.099Z\", \"assignerShortName\": \"certcc\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-node-2024-3566

Vulnerability from bitnami_vulndb

Published

2025-06-18 14:56

Modified

2025-06-18 15:17

Summary

Command injection vulnerability in programing languages on Microsoft Windows operating system.

Details

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "node",
        "purl": "pkg:bitnami/node"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.77.2"
            },
            {
              "fixed": "18.19.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-3566"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.",
  "id": "BIT-node-2024-3566",
  "modified": "2025-06-18T15:17:39.937Z",
  "published": "2025-06-18T14:56:46.820Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "type": "WEB",
      "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3566"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/123335"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Command injection vulnerability in programing languages on Microsoft Windows operating system."
}

FKIE_CVE-2024-3566

Vulnerability from fkie_nvd - Published: 2024-04-10 16:15 - Updated: 2026-05-15 15:03

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

References

URL	Tags
cret@cert.org	https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/	Exploit, Third Party Advisory
cret@cert.org	https://kb.cert.org/vuls/id/123335	Third Party Advisory
cret@cert.org	https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way	Technical Description
cret@cert.org	https://www.cve.org/CVERecord?id=CVE-2024-1874	Not Applicable
cret@cert.org	https://www.cve.org/CVERecord?id=CVE-2024-22423	Not Applicable
cret@cert.org	https://www.cve.org/CVERecord?id=CVE-2024-24576	Not Applicable
cret@cert.org	https://www.kb.cert.org/vuls/id/123335	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://kb.cert.org/vuls/id/123335	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way	Technical Description
af854a3a-2127-422b-91ae-364da2661108	https://www.cve.org/CVERecord?id=CVE-2024-1874	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://www.cve.org/CVERecord?id=CVE-2024-22423	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://www.cve.org/CVERecord?id=CVE-2024-24576	Not Applicable
af854a3a-2127-422b-91ae-364da2661108	https://www.kb.cert.org/vuls/id/123335	Not Applicable

Impacted products

Vendor	Product	Version
haskell	process_library	*
nodejs	node.js	*
nodejs	node.js	*
nodejs	node.js	*
php	php	*
php	php	*
php	php	*
rust-lang	rust	*
yt-dlp_project	yt-dlp	*
microsoft	windows	-

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:haskell:process_library:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "838E7C22-2203-42B8-B8DE-52306C0053CD",
              "versionEndExcluding": "1.6.19.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "22F26905-4C5D-431E-955A-F2A35FA25401",
              "versionEndExcluding": "18.20.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F5CD069C-89BE-43CD-B741-0B976DCC5D2A",
              "versionEndExcluding": "20.12.2",
              "versionStartIncluding": "19.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "43547541-B480-439B-B18C-8FE493599E6F",
              "versionEndExcluding": "21.7.3",
              "versionStartIncluding": "21.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF638A38-6375-40D9-95A8-1013E3B630F9",
              "versionEndExcluding": "8.1.28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2",
              "versionEndExcluding": "8.2.18",
              "versionStartIncluding": "8.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E88C969D-88C3-46A2-96AB-A3F63E814F24",
              "versionEndExcluding": "8.3.6",
              "versionStartIncluding": "8.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C49FDBA9-6417-4761-9CF1-1EF8E70B782C",
              "versionEndExcluding": "1.77.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:yt-dlp_project:yt-dlp:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2C6B8E2D-693F-494C-BE61-CF52780035AF",
              "versionEndExcluding": "2024.04.09",
              "versionStartIncluding": "2021.04.11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyecci\u00f3n de comandos permite a un atacante realizar inyecci\u00f3n de comandos en aplicaciones de Windows que dependen indirectamente de la funci\u00f3n CreateProcess cuando se cumplen las condiciones espec\u00edficas."
    }
  ],
  "id": "CVE-2024-3566",
  "lastModified": "2026-05-15T15:03:11.680",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-04-10T16:15:16.083",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Technical Description"
      ],
      "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
    },
    {
      "source": "cret@cert.org",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kb.cert.org/vuls/id/123335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Technical Description"
      ],
      "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://www.kb.cert.org/vuls/id/123335"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-9XCH-XVJ3-FMF3

Vulnerability from github – Published: 2024-04-10 18:30 – Updated: 2025-11-18 18:32

Details

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-3566"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-10T16:15:16Z",
    "severity": "CRITICAL"
  },
  "details": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.",
  "id": "GHSA-9xch-xvj3-fmf3",
  "modified": "2025-11-18T18:32:45Z",
  "published": "2024-04-10T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3566"
    },
    {
      "type": "WEB",
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2024/CVE-2024-3566"
    },
    {
      "type": "WEB",
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "type": "WEB",
      "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
    },
    {
      "type": "WEB",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/123335"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2024-3566

Vulnerability from gsd - Updated: 2024-04-11 05:03

Details

A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.

Aliases

CVE-2024-3566

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-3566"
      ],
      "details": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.",
      "id": "GSD-2024-3566",
      "modified": "2024-04-11T05:03:27.053396Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cert@cert.org",
        "ID": "CVE-2024-3566",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Node.js",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c=",
                          "version_name": "*",
                          "version_value": "21.7.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Node.js"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "GoLang",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "*"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Go Programming Language"
            },
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Haskel",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "*"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Haskell Programming Language"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."
          }
        ]
      },
      "generator": {
        "engine": "VINCE 2.1.12",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2024-3566"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/",
            "refsource": "MISC",
            "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
          },
          {
            "name": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way",
            "refsource": "MISC",
            "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
          },
          {
            "name": "https://kb.cert.org/vuls/id/123335",
            "refsource": "MISC",
            "url": "https://kb.cert.org/vuls/id/123335"
          },
          {
            "name": "https://www.cve.org/CVERecord?id=CVE-2024-24576",
            "refsource": "MISC",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
          },
          {
            "name": "https://www.cve.org/CVERecord?id=CVE-2024-1874",
            "refsource": "MISC",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
          },
          {
            "name": "https://www.cve.org/CVERecord?id=CVE-2024-22423",
            "refsource": "MISC",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
          },
          {
            "name": "https://www.kb.cert.org/vuls/id/123335",
            "refsource": "MISC",
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ]
      },
      "source": {
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied."
          }
        ],
        "id": "CVE-2024-3566",
        "lastModified": "2024-04-10T19:49:51.183",
        "metrics": {},
        "published": "2024-04-10T16:15:16.083",
        "references": [
          {
            "source": "cret@cert.org",
            "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
          },
          {
            "source": "cret@cert.org",
            "url": "https://kb.cert.org/vuls/id/123335"
          },
          {
            "source": "cret@cert.org",
            "url": "https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way"
          },
          {
            "source": "cret@cert.org",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
          },
          {
            "source": "cret@cert.org",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-22423"
          },
          {
            "source": "cret@cert.org",
            "url": "https://www.cve.org/CVERecord?id=CVE-2024-24576"
          },
          {
            "source": "cret@cert.org",
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ],
        "sourceIdentifier": "cret@cert.org",
        "vulnStatus": "Awaiting Analysis"
      }
    }
  }
}

hsec-2024-0003

Vulnerability from osv_haskell

Published

2025-11-14 14:45

Modified

2025-11-14 14:45

Summary

process: command injection via argument list on Windows

Details

process: command injection via argument list on Windows

The process library on Windows is vulnerable to a command injection vulnerability, via cmd.exe's interpretation of arguments. Programs that invoke batch files (.bat, .cmd) and pass arguments whose values are affected by program inputs may be affected.

This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as VU#123335 and a coordinated disclosure was made on 2024-04-09 17:00 UTC.

A fix was released in process-1.6.19.0.

Background

Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs.

The process library defines the RawCommand constructor for specifying an executable and its arguments:

data CmdSpec
  = ShellCommand String
  | RawCommand FilePath [String]

On Windows, the RawCommand executable name and arguments are serialised into a single command line string, with separate arguments quoted separately. process then invokes the Windows CreateProcess routine with this command line string is given as the lpCommandLine argument.

Issue

When executing .bat or .cmd files, CreateProcess implicitly spawns cmd.exe. The System.Process command line construction does not escape characters with special meaning to cmd.exe. As a consequence, a command injection vulnerability arises when the following conditions are satisfied:

Program running on Windows
Program executes a .bat or .cmd file
The argument values include or are influenced by program input

Demonstration

The following batch file, test.bat, merely prints the executable name the first two arguments (as interpreted by cmd.exe):

@ECHO OFF
ECHO 0: %0
ECHO 1: %1
ECHO 2: %2
PAUSE

The following Haskell program executes test.bat with basic string arguments. The output is as expected:

λ> readProcess "test.bat" ["a","b"] [] >>= putStrLn
0: "test.bat"
1: "a"
2: "b"

However, we can use a close quote and the & character to induce cmd.exe to execute a program named in the argument:

λ> readProcess "test.bat" ["\"&calc.exe"] [] >>= putStrLn
0: "test.bat"
1: "\"
2:

In addition to producing the above output, calc.exe is executed.

Mitigation

The lack of a general mechanism on Windows for safely conveying command line arguments to programs increases the risk of this kind of security issue. The fact that cmd.exe command line parsing is complex and poorly documented exacerbates this issue, and also heightens the risk that the fix is incomplete, or causes other issues.

If possible, avoid executing batch files where arguments include or are influenced by untrusted program inputs. If it must be done, reject arguments that include special characters including & and ".

Fix versions

process was modified to perform additional escaping and quoting when executing .bat and .cmd files on Windows (ignoring character case). The behaviour is unchanged in all other cases.

The fix was released in process-1.6.19.0. The following GHC releases were the first in their series to include a fixed version of the process library:

GHC 9.10.1-alpha3 (released 2024-04-15)
GHC 9.8.3 (released 2024-10-20)
GHC 9.6.5 (released 2024-04-16)

Such a change in semantics should normally result in a major version bump. Because we expect very few (if any) users will be impacted by the behavioural change, the GHC team made a pragmatic decision to avoid the disruption that a major version bump would cause.

A follow-up fix was released in process-1.6.23.0 to handle batch scripts with paths ending in whitespace and periods and unescaped % expansions.

Acknowledgements

Security researcher RyotaK discovered and responsibly disclosed this vulnerability, coordinating the response across the many affected langauges and ecosystems.

Ben Gamari commited and released the fix, which was based on a proposal by Fraser Tweedale. Fraser also improved the System.Process module documentation to better explain the Windows semantics.

Security researcher Kainan Zhang (@4xpl0r3r) discovered and responsibly disclosing the issue in the first fix and the Rust Security Response WG coordinated the response.

References

URL

Type

	https://flatt.tech/research/posts/batbadbut-you-c…	ARTICLE
	https://kb.cert.org/vuls/id/123335	ADVISORY
	https://github.com/haskell/process/commit/3c419f9…	FIX
	https://github.com/haskell/process/commit/951b02d…	FIX
	https://github.com/haskell/process/commit/5fc91f5…	FIX

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0003.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0003.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "process"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0.0"
            },
            {
              "fixed": "1.6.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-3566"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# process: command injection via argument list on Windows\n\nThe *process* library on Windows is vulnerable to a command injection\nvulnerability, via `cmd.exe`\u0027s interpretation of arguments.  Programs that\ninvoke batch files (`.bat`, `.cmd`) and pass arguments whose values are\naffected by program inputs may be affected.\n\nThis issue was discovered in many programming languages\u0027 Windows process\nexecution behaviour.  It was tracked by CERT/CC as **VU#123335** and a\ncoordinated disclosure was made on 2024-04-09 17:00 UTC.\n\nA fix was released in *process-1.6.19.0*.\n\n\n## Background\n\nUnlike POSIX systems, Windows does not have a mechanism for passing multiple\narguments.Command line parsing is up to individual programs.\n\nThe *process* library defines the `RawCommand` constructor for specifying an\nexecutable and its arguments:\n\n```haskell\ndata CmdSpec\n  = ShellCommand String\n  | RawCommand FilePath [String]\n```\n\nOn Windows, the `RawCommand` executable name and arguments are serialised into\na single *command line* string, with separate arguments quoted separately.\n*process* then invokes the Windows [`CreateProcess`][doc-CreateProcess]\nroutine with this command line string is given as the `lpCommandLine`\nargument.\n\n[doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa\n\n\n## Issue\n\nWhen executing `.bat` or `.cmd` files, [`CreateProcess`][doc-CreateProcess]\nimplicitly spawns `cmd.exe`.  The `System.Process` command line construction\ndoes not escape characters with special meaning to `cmd.exe`.  As a\nconsequence, a command injection vulnerability arises when the following\nconditions are satisfied:\n\n- Program running on Windows\n- Program executes a `.bat` or `.cmd` file\n- The argument values include or are influenced by program input\n\n\n## Demonstration\n\nThe following batch file, `test.bat`, merely prints the executable name the\nfirst two arguments (as interpreted by `cmd.exe`):\n\n```\n@ECHO OFF\nECHO 0: %0\nECHO 1: %1\nECHO 2: %2\nPAUSE\n```\n\nThe following Haskell program executes `test.bat` with basic string arguments.\nThe output is as expected:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"a\",\"b\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"a\"\n2: \"b\"\n```\n\nHowever, we can use a close quote and the `\u0026` character to induce `cmd.exe` to\nexecute a program named in the argument:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"\\\"\u0026calc.exe\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"\\\"\n2:\n```\n\nIn addition to producing the above output, `calc.exe` is executed.\n\n\n## Mitigation\n\nThe lack of a general mechanism on Windows for safely conveying command line\narguments to programs increases the risk of this kind of security issue.  The\nfact that `cmd.exe` command line parsing is complex and poorly documented\nexacerbates this issue, and also heightens the risk that the fix is\nincomplete, or causes other issues.\n\nIf possible, avoid executing batch files where arguments include or are\ninfluenced by untrusted program inputs.  If it must be done, reject arguments\nthat include special characters including `\u0026` and `\"`.\n\n\n## Fix versions\n\n*process* was modified to perform additional escaping and quoting\nwhen executing `.bat` and `.cmd` files on Windows (ignoring\ncharacter case).  The behaviour is unchanged in all other cases.\n\nThe fix was released in ***process-1.6.19.0***.  The following GHC\nreleases were the first in their series to include a fixed version\nof the *process* library:\n\n- **GHC 9.10.1-alpha3** (released 2024-04-15)\n- **GHC 9.8.3** (released 2024-10-20)\n- **GHC 9.6.5** (released 2024-04-16)\n\nSuch a change in semantics should normally result in a major version\nbump.  Because we expect very few (if any) users will be impacted by\nthe behavioural change, the GHC team made a pragmatic decision to\navoid the disruption that a major version bump would cause.\n\nA follow-up fix was released in ***process-1.6.23.0*** to handle batch\nscripts with paths ending in whitespace and periods and\nunescaped `%` expansions.\n\n\n## Acknowledgements\n\nSecurity researcher **RyotaK** discovered and responsibly disclosed\nthis vulnerability, coordinating the response across the many\naffected langauges and ecosystems.\n\nBen Gamari commited and released the fix, which was based on a\nproposal by Fraser Tweedale.  Fraser also improved the\n`System.Process` module documentation to better explain the Windows\nsemantics.\n\nSecurity researcher **Kainan Zhang** (@4xpl0r3r) discovered and\nresponsibly disclosing the issue in the first fix and the Rust\nSecurity Response WG coordinated the response.\n",
  "id": "HSEC-2024-0003",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "type": "ADVISORY",
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/3c419f9eeedac024c9dccce544e5a6fb587179a5"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/951b02dd95559b1a26f2456bfb97cf740ea40934"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/5fc91f5f36ed4479be2b95f04f264bb78ac8089d"
    }
  ],
  "related": [
    "CVE-2024-1874",
    "CVE-2024-24576",
    "CVE-2024-22423"
  ],
  "schema_version": "1.5.0",
  "summary": "process: command injection via argument list on Windows"
}

MSRC_CVE-2024-3566

Vulnerability from csaf_microsoft - Published: 2024-04-02 07:00 - Updated: 2026-02-18 15:02

Summary

Command injection vulnerability in programing languages on Microsoft Windows operating system.

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2024-3566

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected products

Known not affected 9 products

Product	Identifier	Version	Remediation
Unresolved product id: 17086-3		—
Unresolved product id: 17086-2		—
Unresolved product id: 17084-1		—
Unresolved product id: 17086-4		—
Unresolved product id: 17084-6		—
Unresolved product id: 17084-7		—
Unresolved product id: 17086-8		—
Unresolved product id: 17086-9		—
Unresolved product id: 17084-5		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system. - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-3566.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Command injection vulnerability in programing languages on Microsoft Windows operating system.",
    "tracking": {
      "current_release_date": "2026-02-18T15:02:20.000Z",
      "generator": {
        "date": "2026-05-22T07:47:24.655Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-3566",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-09-03T19:55:11.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-02-18T15:02:20.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              },
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "category": "product_name",
            "name": "cbl2 golang 0:1.18.8-4.cbl2",
            "product": {
              "name": "cbl2 golang 0:1.18.8-4.cbl2",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 golang 0:1.22.7-1.cbl2",
            "product": {
              "name": "cbl2 golang 0:1.22.7-1.cbl2",
              "product_id": "2"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 golang 0:1.23.3-2.azl3",
            "product": {
              "name": "azl3 golang 0:1.23.3-2.azl3",
              "product_id": "1"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 rust 0:1.72.0-10.cbl2",
            "product": {
              "name": "cbl2 rust 0:1.72.0-10.cbl2",
              "product_id": "4"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 nodejs 0:20.14.0-8.azl3",
            "product": {
              "name": "azl3 nodejs 0:20.14.0-8.azl3",
              "product_id": "6"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 golang 0:1.22.9-1.azl3",
            "product": {
              "name": "azl3 golang 0:1.22.9-1.azl3",
              "product_id": "7"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 golang 0:1.18.8-4.cbl2",
            "product": {
              "name": "cbl2 golang 0:1.18.8-4.cbl2",
              "product_id": "8"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 rust 0:1.72.0-10.cbl2",
            "product": {
              "name": "cbl2 rust 0:1.72.0-10.cbl2",
              "product_id": "9"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 rust 0:1.75.0-14.azl3",
            "product": {
              "name": "azl3 rust 0:1.75.0-14.azl3",
              "product_id": "5"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 golang 0:1.18.8-4.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 golang 0:1.22.7-1.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 golang 0:1.23.3-2.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 rust 0:1.72.0-10.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs 0:20.14.0-8.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 golang 0:1.22.9-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 golang 0:1.18.8-4.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 rust 0:1.72.0-10.cbl2 as a component of CBL Mariner 2.0",
          "product_id": "17086-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 0:1.75.0-14.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-3566",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17086-3",
            "17086-2",
            "17084-1",
            "17086-4",
            "17084-6",
            "17084-7",
            "17086-8",
            "17086-9",
            "17084-5"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "certcc",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "17086-3",
          "17086-2",
          "17084-1",
          "17086-4",
          "17084-6",
          "17084-7",
          "17086-8",
          "17086-9",
          "17084-5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system. - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-3566.json"
        }
      ],
      "title": "Command injection vulnerability in programing languages on Microsoft Windows operating system."
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-3566 (GCVE-0-2024-3566)

bit-node-2024-3566

Vulnerability from bitnami_vulndb

FKIE_CVE-2024-3566

GHSA-9XCH-XVJ3-FMF3

GSD-2024-3566

hsec-2024-0003

Vulnerability from osv_haskell

process: command injection via argument list on Windows

Background

Issue

Demonstration

Mitigation

Fix versions

Acknowledgements

MSRC_CVE-2024-3566

Tags

Sightings

Nomenclature