CVE-2024-45401
📋 TL;DR
A path traversal vulnerability in stripe-cli allows attackers to overwrite arbitrary files on the system when installing plugins with malformed shortnames via --archive-url or --archive-path flags. This affects users of stripe-cli versions 1.11.1 through 1.21.2 who install plugins from archives. The vulnerability could lead to file corruption, privilege escalation, or remote code execution.
💻 Affected Systems
- stripe-cli
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary file overwrite leading to privilege escalation, remote code execution, or destruction of critical system files.
Likely Case
Local file corruption or unauthorized modification of configuration files, potentially disrupting payment processing workflows.
If Mitigated
No impact if plugin installation from archives is disabled or if vulnerable versions are not used.
🎯 Exploit Status
Exploitation requires user interaction to install a malicious plugin archive. No evidence of exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.21.3
Vendor Advisory: https://github.com/stripe/stripe-cli/security/advisories/GHSA-fv4g-gwpj-74gr
Restart Required: No
Instructions:
1. Update stripe-cli to version 1.21.3 or later using your package manager. 2. For npm: 'npm update -g stripe-cli'. 3. For direct install: Download latest from GitHub releases. 4. Verify version with 'stripe version'.
🔧 Temporary Workarounds
Disable plugin installation from archives
allAvoid using --archive-url or --archive-path flags when installing plugins
# Only install plugins from trusted sources without archive flags
# stripe plugins install <plugin-name>
Remove vulnerable versions
allUninstall vulnerable stripe-cli versions
# npm: npm uninstall -g stripe-cli
# macOS brew: brew uninstall stripe-cli
# Linux: sudo apt remove stripe-cli or equivalent
🧯 If You Can't Patch
- Restrict stripe-cli usage to trusted users only
- Implement strict change control for plugin installation processes
🔍 How to Verify
Check if Vulnerable:
Run 'stripe version' and check if version is between 1.11.1 and 1.21.2 inclusive.Check Version:
stripe versionVerify Fix Applied:
Run 'stripe version' and confirm version is 1.21.3 or higher.📡 Detection & Monitoring
Log Indicators:
- Plugin installation logs with --archive-url or --archive-path flags
- Unexpected file modification events in system directories
Network Indicators:
- Downloads from unusual URLs during plugin installation
SIEM Query:
process.name:"stripe" AND cmd_line:"*--archive-url*" OR cmd_line:"*--archive-path*"