Executive brief
The Snyk gradle plugin is used by developers to scan Java projects for security vulnerabilities. The plugin is vulnerable to OS command injection when scanning untrusted Gradle projects, allowing an attacker to execute arbitrary system commands if a developer runs a scan in a directory controlled by the attacker. This could lead to code execution during the security scanning process.
Technical details
The vulnerability is an OS command injection (CWE-78/CWE-94) triggered by improper handling of the current working directory name in the gradle plugin. The attack vector requires user interaction—a developer must execute Snyk test within an untrusted Gradle project, typically one downloaded or cloned from a malicious source. The vulnerability allows arbitrary command execution within the context of the scanning process. The issue was fixed in version 4.5.0 of snyk-gradle-plugin, with the fix addressing the handling of gradle wrapper files and command argument sanitization.
Affected products
- Snyk snyk-gradle-plugin all versions before 4.5.0
Timeline
- 2024-10-23: disclosed
- 2024-10-03: patched: Fix merged in version 4.5.0