Is CVE-2022-24441 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24441 being exploited in the wild.

How severe is CVE-2022-24441?

Low severity, with a CVSS score of 3.1, published 6 July 2023.

Which products and versions are affected?

snyk (npm) SEMVER:introduced=0,fixed=1.1064.0; Snyk Eclipse Plugin before v20221115.132308 (fixed in all subsequent versions); Snyk IntelliJ Plugin before 2.4.48; Snyk Language Server before v20221109.114426 (fixed in all subsequent versions); and 2 more.

Is there a fix for CVE-2022-24441?

Yes. snyk (npm): upgrade to 1.1064.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24441 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2022-24441?

Check whether you run snyk (npm), Snyk Eclipse Plugin, Snyk IntelliJ Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24441: Snyk code injection via malicious build files

CVE-2022-24441 · Severity: low · CVSS 3.1 · Published 2023-07-06

Snyk is a popular security scanning tool that analyzes project dependencies for vulnerabilities. A code injection flaw allows attackers to execute arbitrary commands when a user scans a malicious project containing specially crafted build files (like build.gradle or gradle-wrapper.jar). This could give an attacker full control over the user's system or development environment, particularly if exploited through IDE plugins.

Technologies: snyk (npm). Vendors: npm, Snyk.

Quick answers

Is CVE-2022-24441 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-24441 being exploited in the wild.
How severe is CVE-2022-24441?: Low severity, with a CVSS score of 3.1, published 6 July 2023.
Which products and versions are affected?: snyk (npm) SEMVER:introduced=0,fixed=1.1064.0; Snyk Eclipse Plugin before v20221115.132308 (fixed in all subsequent versions); Snyk IntelliJ Plugin before 2.4.48; Snyk Language Server before v20221109.114426 (fixed in all subsequent versions); and 2 more.
Is there a fix for CVE-2022-24441?: Yes. snyk (npm): upgrade to 1.1064.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24441 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2022-24441?: Check whether you run snyk (npm), Snyk Eclipse Plugin, Snyk IntelliJ Plugin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snyk (npm): upgrade to 1.1064.0 or later
```
npm install snyk@1.1064.0
```

Technical details

This is a code injection vulnerability (CWE-78, CWE-94) in Snyk's project analysis logic. When Snyk scans a project, it processes build configuration files including Gradle files. An attacker can embed malicious commands in these files that are executed during the scan with the privileges of the user running Snyk. The vulnerability affects Snyk CLI (fixed in 1.1064.0) and multiple IDE plugins: VS Code (≤1.8.0), IntelliJ (≤2.4.47), Visual Studio (≤1.1.30), Eclipse (≤v20221115.132308), and Language Server (≤v20221109.114426). Exploitation requires social engineering to convince a user to scan a malicious project, or in IDEs with trust features, marking a folder as trusted. The attack vector is primarily local/adjacent-network and requires user interaction (initiating a scan or opening a project in an IDE).

Affected products

Snyk snyk before 1.1064.0
Snyk VS Code Extension before 1.9.0
Snyk IntelliJ Plugin before 2.4.48
Snyk Visual Studio Plugin before 1.1.31
Snyk Eclipse Plugin before v20221115.132308 (fixed in all subsequent versions)
Snyk Language Server before v20221109.114426 (fixed in all subsequent versions)

Identifiers

CVE-2022-24441
GHSA-4vrv-93c7-m92j

Timeline

2023-07-06: disclosed
2022-11-29: patched: Fixes released for IDE plugins and language server with trust feature implementation
2022-11-30: other: Published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.