CVE-2023-40030

Cargo downloads a Rust project’s dependencies and compiles the project.
Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Cargo
feature names when including them in the report generated by cargo build --timings. A malicious package included as a dependency may inject nearly
arbitrary HTML here, potentially leading to cross-site scripting if the
report is subsequently uploaded somewhere. The vulnerability affects users
relying on dependencies from git, local paths, or alternative registries.
Users who solely depend on crates.io are unaffected. Rust 1.60.0 introduced
cargo build --timings, which produces a report of how long the different
steps of the build process took. It includes lists of Cargo features for
each crate. Prior to Rust 1.72, Cargo feature names were allowed to contain
almost any characters (with some exceptions as used by the feature syntax),
but it would produce a future incompatibility warning about them since Rust
1.49. crates.io is far more stringent about what it considers a valid
feature name and has not allowed such feature names. As the feature names
were included unescaped in the timings report, they could be used to inject
Javascript into the page, for example with a feature name like features = ["<img src='' onerror=alert(0)"]. If this report were subsequently
uploaded to a domain that uses credentials, the injected Javascript could
access resources from the website visitor. This issue was fixed in Rust
1.72 by turning the future incompatibility warning into an error. Users
should still exercise care in which package they download, by only
including trusted dependencies in their projects. Please note that even
with these vulnerabilities fixed, by design Cargo allows arbitrary code
execution at build time thanks to build scripts and procedural macros: a
malicious dependency will be able to cause damage regardless of these
vulnerabilities. crates.io has server-side checks preventing this attack,
and there are no packages on crates.io exploiting these vulnerabilities.
crates.io users still need to excercise care in choosing their dependencies
though, as remote code execution is allowed by design there as well.

Notes