Code Execution in Internment Crate via Rogue Dependency

Executive Summary

This vulnerability involves a supply chain attack in the Rust ecosystem where malicious code is executed during the compilation of a project. The attack uses a typosquatted crate named proc-macro1, which is a dependency of the internment crate version 0.8.7. The build script of proc-macro1 downloads and executes a remote payload from a command-and-control server, compromising the build process.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of malicious crates like arrayref 0.3.10, proc-macro1 1.0.107, or internment 0.8.7 in your project's Cargo.lock or dependency list. Look for unexpected network connections to IP 23.254.165.112 on ports 9089 or 443 during build processes. Inspect build scripts for base64-encoded server addresses or disabled TLS validation. Search for files named rust-setup, rust-setup.ps1, or rust-setup-launch.vbs in temporary directories.

Useful 0 Not Useful 0

Impact Analysis

If you compile a project using the affected internment crate version 0.8.7, your system could execute arbitrary malicious code without your knowledge. This could lead to data theft, system compromise, or further propagation of malware to other systems. The attack is silent and runs during build time, making it hard to detect.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected Rust projects may face compliance breaches, legal penalties, and reputational damage due to potential data leaks or system compromises.

Useful 0 Not Useful 0

Mitigation Strategies

Remove affected crates (arrayref 0.3.10, proc-macro1 1.0.107, internment 0.8.7) from your project. Use versions of arrayref 0.3.9 or lower, or internment 0.8.6 or lower. Block network access to IP 23.254.165.112. Audit dependencies for typosquatted crates like proc-macro1. Consider using tools like cargo-audit or cargo-deny to verify crate integrity.

Useful 0 Not Useful 0