CVE-2022-24441: Code Injection
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. NOTE: This issue is independent of the one reported in CVE-2022-40764, and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Other sources
The package snyk before 1.1064.0 is vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable.
NOTE: This issue is independent of the one reported in CVE-2022-40764, and upgrading to a fixed version for this addresses that issue as well.
The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-24441?
CVE-2022-24441 is a vulnerability in the Snyk package before version 1.1064.0 that allows code injection when analyzing a project.
How can an attacker exploit CVE-2022-24441?
An attacker can exploit CVE-2022-24441 by convincing a user to scan a malicious project that includes commands in a build file, such as build.gradle or gradle-wrapper.jar, which will be executed with the application's privileges.
Which software versions are affected by CVE-2022-24441?
The Snyk CLI before version 1.1064.0, Snyk Language Server before version 20221109.114426, Snyk Security before version 1.1.30 (for Visual Studio), 1.8.0 (for Visual Studio Code), 2.4.47 (for IntelliJ), and Snyk Security before version 20221115.132308 (for Eclipse) are affected by CVE-2022-24441.
What is the severity of CVE-2022-24441?
CVE-2022-24441 has a severity rating of 8.8 (high).
How can I fix CVE-2022-24441?
To fix CVE-2022-24441, users should upgrade to Snyk version 1.1064.0 (for Snyk CLI), version 20221109.114426 (for Snyk Language Server), version 1.1.30 (for Visual Studio), version 1.8.0 (for Visual Studio Code), version 2.4.47 (for IntelliJ), or version 20221115.132308 (for Eclipse).