CVE-2024-48963
📋 TL;DR
Snyk CLI versions before 1.1294.0 are vulnerable to code injection when scanning untrusted PHP projects. Attackers can execute arbitrary code by tricking users into running 'snyk test' within a malicious project directory. This affects developers and security teams using Snyk CLI for PHP project analysis.
💻 Affected Systems
- Snyk CLI
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running Snyk CLI, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution within the context of the user running Snyk, allowing attackers to steal credentials, modify files, or install malware.
If Mitigated
No impact if scanning only trusted projects or using patched versions.
🎯 Exploit Status
Exploitation requires user interaction (running snyk test) and access to modify project directory names. No authentication bypass needed beyond local file system access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1294.0
Vendor Advisory: https://github.com/snyk/snyk-php-plugin/releases/tag/v1.10.0
Restart Required: No
Instructions:
1. Update Snyk CLI: npm update -g snyk 2. Verify version: snyk --version 3. Ensure version is 1.1294.0 or higher
🔧 Temporary Workarounds
Avoid scanning untrusted projects
allOnly run Snyk test on trusted PHP projects as recommended by vendor
Sandbox scanning environment
linuxRun Snyk CLI in isolated containers or VMs when scanning third-party code
docker run --rm -v $(pwd):/app snyk/snyk-cli test
🧯 If You Can't Patch
- Restrict Snyk CLI usage to trusted administrators only
- Implement mandatory code review before Snyk scanning of external projects
🔍 How to Verify
Check if Vulnerable:
Run: snyk --version and check if version is below 1.1294.0Check Version:
snyk --versionVerify Fix Applied:
Run: snyk --version and confirm version is 1.1294.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution from Snyk CLI
- Snyk test commands running in unusual directories
Network Indicators:
- Outbound connections from Snyk process to unexpected destinations
SIEM Query:
process.name:snyk AND process.args:*test* AND file.path:*untrusted*