CVE-2022-40764

Vulnerability

Overview CVE-2022-40764 is a command injection vulnerability in the Snyk command-line interface (CLI) prior to version 1.996.0. The vulnerability arises from improper sanitization of user-controlled input in the vendor.json ignore field, which is processed by the snyk-go-plugin. Attackers can inject shell metacharacters to execute arbitrary commands on the host system [1][3]. This affects Snyk IDE plugins, the snyk npm package, and CI/CD integrations like the Snyk TeamCity plugin [1].

Exploitation

Scenario Exploitation can occur when a user scans an untrusted project, such as opening a malicious repository in Visual Studio Code with the Snyk extension installed. The attacker crafts a vendor.json file with a malicious ignore field, and when the Snyk CLI processes it during a scan, the injected commands are executed. No special privileges are required beyond the ability to run a Snyk scan on untrusted input [3].

Impact

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the user running the Snyk CLI. This could lead to data exfiltration, file modification, or installation of malware. The vulnerability is particularly dangerous because it can be triggered by simply viewing untrusted files in an IDE [1][3].

Mitigation

Snyk released a fix in CLI version 1.996.0, and users are advised to update immediately [4]. The Snyk TeamCity plugin must be manually updated to version 20220930.142957 or later [1]. Related vulnerabilities CVE-2022-24441 and CVE-2022-22984 have also been addressed [3].