Executive brief
The Snyk PHP plugin, a code scanning tool used to identify security vulnerabilities in PHP projects, contains an OS command injection flaw triggered by improper handling of the project directory name. An attacker can exploit this by crafting a malicious directory name; when Snyk scans the project, arbitrary system commands may execute, leading to potential data theft, system compromise, or lateral movement within the scanned environment.
Technical details
This vulnerability is an OS command injection (CWE-78) in the Snyk PHP plugin that arises from unsafe construction of shell commands using the current working directory name. The flaw can be triggered when running `snyk test` inside an untrusted PHP project directory—no authentication is required, but user interaction (running the scan tool) is necessary. The vulnerable code passes the directory name directly into a shell spawn call without proper sanitization or argument separation. An attacker can achieve arbitrary command execution in the context of the user running Snyk. The vulnerability was fixed in version 1.10.0 by properly separating command and arguments in the spawn call to prevent shell injection.
Affected products
- Snyk snyk-php-plugin before 1.10.0
Timeline
- 2024-10-23: disclosed
- 2024-10-23: patched: Fixed in version 1.10.0