Junglewise Threat Intelligence

CVE-2022-22984: Snyk plugins command injection

CVE-2022-22984 · Severity: low · CVSS 3.1 · Published 2022-11-30

Technologies: snyk (npm). Vendors: Snyk, npm.

Executive brief

Snyk's vulnerability scanning tools and plugins contained a command injection flaw that could allow attackers to execute arbitrary commands on systems running the Snyk CLI. An attacker could exploit this by crafting malicious command-line arguments passed to the Snyk test command, potentially compromising build pipelines and CI/CD systems where developers use these tools to scan project dependencies for security issues.

Technical details

This is a command injection vulnerability (CWE-78) in Snyk's CLI and plugin suite resulting from an incomplete fix for CVE-2022-40764. The vulnerability stems from improper escaping of child process arguments when spawning subprocesses. An attacker can inject arbitrary shell commands by manipulating command-line flags passed to the snyk test command. Exploitation requires that a user executes the Snyk CLI on attacker-controlled or untrusted files, but in CI/CD pipeline contexts where developers control arguments, this can be leveraged for pipeline compromise. The issue has been patched across all affected plugins by properly escaping/quoting spawn arguments before passing them to child processes.

Affected products

  • Snyk snyk before 1.1064.0
  • Snyk snyk-mvn-plugin before 2.31.3
  • Snyk snyk-gradle-plugin before 3.24.5
  • Snyk snyk-cocoapods-plugin before 2.5.3
  • Snyk snyk-sbt-plugin before 2.16.2
  • Snyk snyk-python-plugin before 1.24.2
  • Snyk snyk-docker-plugin before 5.6.5
  • Snyk snyk-hex-plugin before 1.1.6

Timeline

  • 2022-11-30: disclosed: Advisory published
  • 2022-11-29: patched: Fixes available in Snyk Docker images as of 2022-11-29
  • 2022-11-30: other: Snyk TeamCity CI/CD plugin patched as of version v20221130.093605

References

Related threats