CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
71.3%
Cargo downloads a Rust project’s dependencies and compiles the project.
Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo
feature names when including them in the report generated by cargo build --timings
. A malicious package included as a dependency may inject nearly
arbitrary HTML here, potentially leading to cross-site scripting if the
report is subsequently uploaded somewhere. The vulnerability affects users
relying on dependencies from git, local paths, or alternative registries.
Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced
cargo build --timings
, which produces a report of how long the different
steps of the build process took. It includes lists of Cargo features for
each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain
almost any characters (with some exceptions as used by the feature syntax),
but it would produce a future incompatibility warning about them since Rust
1.49. crates.io is far more stringent about what it considers a valid
feature name and has not allowed such feature names. As the feature names
were included unescaped in the timings report, they could be used to inject
Javascript into the page, for example with a feature name like features = ["<img src='' onerror=alert(0)"]
. If this report were subsequently
uploaded to a domain that uses credentials, the injected Javascript could
access resources from the website visitor. This issue was fixed in Rust
1.72 by turning the future incompatibility warning into an error. Users
should still exercise care in which package they download, by only
including trusted dependencies in their projects. Please note that even
with these vulnerabilities fixed, by design Cargo allows arbitrary code
execution at build time thanks to build scripts and procedural macros: a
malicious dependency will be able to cause damage regardless of these
vulnerabilities. crates.io has server-side checks preventing this attack,
and there are no packages on crates.io exploiting these vulnerabilities.
crates.io users still need to excercise care in choosing their dependencies
though, as remote code execution is allowed by design there as well.
Author | Note |
---|---|
sbeattie | cargo in mantic was merged into rustc |
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 18.04 | noarch | cargo | < any | UNKNOWN |
ubuntu | 20.04 | noarch | cargo | < any | UNKNOWN |
ubuntu | 22.04 | noarch | cargo | < any | UNKNOWN |
ubuntu | 16.04 | noarch | cargo | < any | UNKNOWN |
ubuntu | 18.04 | noarch | rustc | < any | UNKNOWN |
ubuntu | 20.04 | noarch | rustc | < any | UNKNOWN |
ubuntu | 22.04 | noarch | rustc | < any | UNKNOWN |
ubuntu | 24.04 | noarch | rustc | < any | UNKNOWN |
ubuntu | 14.04 | noarch | rustc | < any | UNKNOWN |
ubuntu | 16.04 | noarch | rustc | < any | UNKNOWN |
github.com/rust-lang/cargo/commit/9835622853f08be9a4b58ebe29dcec8f43b64b33
github.com/rust-lang/cargo/commit/f975722a0eac934c0722f111f107c4ea2f5c4365
github.com/rust-lang/cargo/pull/12291
github.com/rust-lang/cargo/security/advisories/GHSA-wrrj-h57r-vx9p
launchpad.net/bugs/cve/CVE-2023-40030
nvd.nist.gov/vuln/detail/CVE-2023-40030
security-tracker.debian.org/tracker/CVE-2023-40030
www.cve.org/CVERecord?id=CVE-2023-40030