Junglewise Threat Intelligence

CVE-2022-24441: Snyk code injection via malicious build files

CVE-2022-24441 · Severity: low · CVSS 3.1 · Published 2023-07-06

Technologies: snyk (npm). Vendors: Snyk, npm.

Executive brief

Snyk is a popular security scanning tool that analyzes project dependencies for vulnerabilities. A code injection flaw allows attackers to execute arbitrary commands when a user scans a malicious project containing specially crafted build files (like build.gradle or gradle-wrapper.jar). This could give an attacker full control over the user's system or development environment, particularly if exploited through IDE plugins.

Technical details

This is a code injection vulnerability (CWE-78, CWE-94) in Snyk's project analysis logic. When Snyk scans a project, it processes build configuration files including Gradle files. An attacker can embed malicious commands in these files that are executed during the scan with the privileges of the user running Snyk. The vulnerability affects Snyk CLI (fixed in 1.1064.0) and multiple IDE plugins: VS Code (≤1.8.0), IntelliJ (≤2.4.47), Visual Studio (≤1.1.30), Eclipse (≤v20221115.132308), and Language Server (≤v20221109.114426). Exploitation requires social engineering to convince a user to scan a malicious project, or in IDEs with trust features, marking a folder as trusted. The attack vector is primarily local/adjacent-network and requires user interaction (initiating a scan or opening a project in an IDE).

Affected products

  • Snyk snyk before 1.1064.0
  • Snyk VS Code Extension before 1.9.0
  • Snyk IntelliJ Plugin before 2.4.48
  • Snyk Visual Studio Plugin before 1.1.31
  • Snyk Eclipse Plugin before v20221115.132308 (fixed in all subsequent versions)
  • Snyk Language Server before v20221109.114426 (fixed in all subsequent versions)

Timeline

  • 2023-07-06: disclosed
  • 2022-11-29: patched: Fixes released for IDE plugins and language server with trust feature implementation
  • 2022-11-30: other: Published on NVD

References

Related threats