Is CVE-2024-48964 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-48964 being exploited in the wild.

How severe is CVE-2024-48964?

Low severity, with a CVSS score of 3.1, published 23 October 2024.

Which products and versions are affected?

snyk-gradle-plugin (npm) SEMVER:introduced=0,fixed=4.5.0.

Is there a fix for CVE-2024-48964?

Yes. snyk-gradle-plugin (npm): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-48964 attacked?

It is attacked over the network.

Am I affected by CVE-2024-48964?

Check whether you run snyk-gradle-plugin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-48964: Snyk gradle plugin OS command injection

CVE-2024-48964 · Severity: low · CVSS 3.1 · Published 2024-10-23

The Snyk gradle plugin is used by developers to scan Java projects for security vulnerabilities. The plugin is vulnerable to OS command injection when scanning untrusted Gradle projects, allowing an attacker to execute arbitrary system commands if a developer runs a scan in a directory controlled by the attacker. This could lead to code execution during the security scanning process.

Vendors: npm.

Quick answers

Is CVE-2024-48964 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-48964 being exploited in the wild.
How severe is CVE-2024-48964?: Low severity, with a CVSS score of 3.1, published 23 October 2024.
Which products and versions are affected?: snyk-gradle-plugin (npm) SEMVER:introduced=0,fixed=4.5.0.
Is there a fix for CVE-2024-48964?: Yes. snyk-gradle-plugin (npm): upgrade to 4.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-48964 attacked?: It is attacked over the network.
Am I affected by CVE-2024-48964?: Check whether you run snyk-gradle-plugin (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snyk-gradle-plugin (npm): upgrade to 4.5.0 or later
```
npm install snyk-gradle-plugin@4.5.0
```

Technical details

The vulnerability is an OS command injection (CWE-78/CWE-94) triggered by improper handling of the current working directory name in the gradle plugin. The attack vector requires user interaction—a developer must execute Snyk test within an untrusted Gradle project, typically one downloaded or cloned from a malicious source. The vulnerability allows arbitrary command execution within the context of the scanning process. The issue was fixed in version 4.5.0 of snyk-gradle-plugin, with the fix addressing the handling of gradle wrapper files and command argument sanitization.

Affected products

Snyk snyk-gradle-plugin all versions before 4.5.0

Identifiers

CVE-2024-48964
GHSA-qqqw-gm93-qf6m

Timeline

2024-10-23: disclosed
2024-10-03: patched: Fix merged in version 4.5.0

References

https://github.com/snyk/snyk-gradle-plugin/commit/2f5ee7579f00660282dd161a0b79690f4a9c865d

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.