Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-51756
CVE-2024-51756:
Rust vulnerability analysis and mitigation
Overview
CVE-2024-51756 affects the cap-std project, which provides libraries for writing capability-based code. The vulnerability was discovered in the filesystem sandbox implementation on Windows, where it failed to block access to special device filenames using superscript digits (e.g., 'COM¹', 'COM²', 'LPT⁰', 'LPT¹'). The issue was disclosed on November 5, 2024, and affects versions prior to 3.4.1 of cap-std, cap-primitives, and cap-async-std packages (GitHub Advisory).
Technical details
The vulnerability stems from incomplete filtering of Windows special device filenames in the sandbox implementation. While the system blocked standard device names like 'COM1' and 'LPT1', it failed to recognize and block their superscript digit variants. These superscript digits are recognized by Windows as valid parts of device names according to the ISO/IEC 8859-1 standard. The vulnerability has been assigned a CVSS v4.0 base score of 2.3 (Low) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N (GitHub Advisory).
Impact
The vulnerability allows untrusted filesystem paths to bypass the sandbox and gain access to peripheral devices connected to the computer or network resources mapped to those devices. This includes access to modems, printers, network printers, and any other device connected to a serial or parallel port, including emulated USB serial ports (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been fixed in version 3.4.1 of cap-primitives, cap-std, and cap-async-std packages. There are no known workarounds for this issue, and affected Windows users are recommended to upgrade to the patched versions (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management