CVE-2022-24441: Code Injection
First published: Wed Nov 30 2022(Updated: )
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Snyk Snyk Cli | <1.1064.0 | |
| Snyk Snyk Language Server | <=20221109.114426 | |
| Snyk Snyk Security | <=1.1.30 | |
| Snyk Snyk Security | <=1.8.0 | |
| Snyk Snyk Security | <=2.4.47 | |
| Snyk Snyk Security | <=20221115.132308 |
Remedy
https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/snyk/snyk-eclipse-plugin/commit/b5a8bce25a359ced75f83a729fc6b2393fc9a495
- https://github.com/snyk/snyk-intellij-plugin/commit/56682f4ba6081ce1d95cb980cbfacd3809a826f4
- https://github.com/snyk/snyk-ls/commit/b3229f0142f782871aa72d1a7dcf417546d568ed
- https://github.com/snyk/snyk-visual-studio-plugin/commit/0b53dbbd4a3153c3ef9aaf797af3b5caad0f731a
- https://github.com/snyk/vscode-extension/commit/0db3b4240be0db6a0a5c6d02c0d4231a2c4ba708
- https://security.snyk.io/vuln/SNYK-JS-SNYK-3111871
- https://www.imperva.com/blog/how-scanning-your-projects-for-security-issues-can-lead-to-remote-code-execution/
Frequently Asked Questions
What is CVE-2022-24441?
CVE-2022-24441 is a vulnerability in the Snyk package before version 1.1064.0 that allows code injection when analyzing a project.
How can an attacker exploit CVE-2022-24441?
An attacker can exploit CVE-2022-24441 by convincing a user to scan a malicious project that includes commands in a build file, such as build.gradle or gradle-wrapper.jar, which will be executed with the application's privileges.
Which software versions are affected by CVE-2022-24441?
The Snyk CLI before version 1.1064.0, Snyk Language Server before version 20221109.114426, Snyk Security before version 1.1.30 (for Visual Studio), 1.8.0 (for Visual Studio Code), 2.4.47 (for IntelliJ), and Snyk Security before version 20221115.132308 (for Eclipse) are affected by CVE-2022-24441.
What is the severity of CVE-2022-24441?
CVE-2022-24441 has a severity rating of 8.8 (high).
How can I fix CVE-2022-24441?
To fix CVE-2022-24441, users should upgrade to Snyk version 1.1064.0 (for Snyk CLI), version 20221109.114426 (for Snyk Language Server), version 1.1.30 (for Visual Studio), version 1.8.0 (for Visual Studio Code), version 2.4.47 (for IntelliJ), or version 20221115.132308 (for Eclipse).
- collector/nvd-index
- agent/weakness
- agent/type
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/severity
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- agent/source
- vendor/snyk
- canonical/snyk snyk cli
- canonical/snyk snyk language server
- version/snyk snyk language server/20221109.114426
- canonical/snyk snyk security
- version/snyk snyk security/1.1.30
- version/snyk snyk security/1.8.0
- version/snyk snyk security/2.4.47
- version/snyk snyk security/20221115.132308