SoylentNews

An anonymous coward writes:

http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-shell-vulnerability/

"A class of coding vulnerabilities could allow attackers to fool Windows system administrators into running malicious code because of a simple omission: quotation marks."

---

The comments on the Ars Technica article are well worth reading for additional examples and descriptions. Better still, take a look at Command-injection vulnerability for COMMAND-Shell Scripts over at The Security Factory. The author provides a well-developed progression of possible attack vectors under Windows where environment variables and directory names can be used maliciously. In general, one should always surround references to %CD% (i.e. the current directory) with quotes:

SET startdir="%CD%"

Another interesting case is illustrated by this code sample:

SET B=T"&calc&
SET C="%B%"

where accessing the value of the environment variable B, even though it is quoted, causes the system to try and invoke a program called "calc" (i.e. the Windows calculator.)