CVE-2024-3566

The vulnerability results from improper handling of command-line arguments passed to the CreateProcess function in Windows. When certain conditions are met, an attacker can inject additional system commands through crafted input data. This affects applications written in Haskell (Process library), Node.js, and PHP, which indirectly call CreateProcess without proper argument sanitization. As a result, a malicious payload can be interpreted by the operating system as a separate command.

An attacker can gain full control over the system — execute arbitrary code, access sensitive data, and disrupt the operation of applications or entire servers (violation of confidentiality, integrity, and availability).

Patches available from individual environment vendors (Haskell, Node.js, PHP) should be applied according to the references. Additionally, it is recommended to verify and sanitize all input data passed to functions that launch system processes on the Windows platform.

Windows applications using: Haskell Process Library, Node.js environment, and PHP — in versions specified in the manufacturer's references — that indirectly call the CreateProcess function.