CVE-2022-24753

Executive Summary

CVE-2022-24753 is a code injection vulnerability in the Stripe CLI tool affecting Windows operating systems only. When specific commands (stripe login, stripe config -e, stripe community, and stripe open) are executed in a directory where an attacker has planted malicious files, the vulnerability permits arbitrary code execution in the context of the currently logged-in user. Stripe released version 1.7.13 to address this flaw by introducing an error-checking mechanism that halts execution before the injected code can run. macOS and Linux systems are not affected. The CVSS score of 7.7 reflects the high integrity and confidentiality impact, though exploitation requires local access and user interaction.

Technical Analysis

The vulnerability exists in the Stripe CLI's handling of commands executed within attacker-controlled directories on Windows. The CNA title — "Code injection in Stripe CLI on windows" — indicates the flaw falls under the CWE-94 class (code injection). The vulnerability mechanism stems from insufficient validation of files present in the working directory when the CLI processes certain subcommands.

The four affected commands are:

• stripe login — initiates authentication against the Stripe API
• stripe config -e — opens the configuration file in an external editor
• stripe community — launches community resources
• stripe open — opens Stripe-related URLs

On Windows, these commands likely resolve files or resources relative to the current working directory without adequate path traversal checks or file authenticity validation. An attacker who can plant files in a directory where a victim subsequently runs one of these commands can cause the CLI to load or execute attacker-controlled content. On Windows, this is particularly dangerous because of how the operating system resolves executables, dynamic-link libraries, or file associations within the current path.

The NVD description does not provide specific technical implementation details such as function names or exact file paths. However, the mechanism is consistent with a common Windows attack pattern where an application relies on its current directory to resolve auxiliary files (e.g., configuration templates, certificate files, editor associations) rather than using fully-qualified paths or validating file integrity.

The vendor's fix — throwing an error in these situations before the code can run — suggests the patch adds explicit validation that detects when the CLI is operating in a context with suspicious files and aborts execution. The lack of workarounds indicates the underlying issue is systemic to how the Windows version of the tool handles its environment.

There is no technical detail provided about which specific file types or directory structures trigger the vulnerability, and no public exploit code is available. The EPSS score of 0.00334 places this vulnerability in the 26.1st percentile of actively exploited CVEs, suggesting limited real-world exploitation activity at the time of scoring.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain is as follows:

Stage 1 — Reconnaissance and Target Identification: An attacker identifies a Windows user who regularly utilizes the Stripe CLI for development or commerce administration. The attacker must have the ability to write files to a directory where the victim will eventually execute CLI commands — this could be a shared file share, a project repository the victim clones, or any directory delivered via social engineering.

Stage 2 — Triggering the Vulnerability: The attacker plants malicious files in the target directory. These files are crafted to be interpreted by the Stripe CLI when the victim runs one of the four affected commands (stripe login, stripe config -e, stripe community, or stripe open) from within that directory. The precise trigger mechanism is not documented in available data, but the code injection class suggests the CLI loads or processes attacker-controlled content without sufficient validation.

Stage 3 — Payload Execution: When the victim changes into the compromised directory and executes an affected command, the injected code runs in the context of the current user. Since the CVSS vector indicates high privileges (C:H/I:H) and the NVD description confirms "arbitrary code run in the context of the current user," the attacker can execute commands, install persistent backdoors, or steal credentials with the victim's user-level privileges.

Stage 4 — Post-Exploitation Impact: Depending on the privileges of the compromised user, the attacker could exfiltrate Stripe API keys stored in CLI configuration, access sensitive eCommerce data, pivot to other systems, or escalate privileges further if the user has administrative rights. The local attack vector and requirement for user interaction align with a "plant-and-wait" attack scenario common in supply chain or shared development environment attacks.

No public PoC is available; this attack chain is inferred from the vulnerability class and affected commands described in the official data.

Impact Assessment

The CVSS score of 7.7 (High severity) with a vector indicating Local (AV:L), High attack complexity (AC:H), Low privileges required (PR:L), and User interaction (UI:R) reflects a moderate-complexity attack requiring local access but yielding high confidentiality, integrity, and availability (C:H/I:H/A:H) impacts with scope change (S:C), meaning the compromised component can impact resources beyond its original security scope.

Business Impact:

• Credential theft: Stripe CLI configuration stores API keys that, if exfiltrated, could enable unauthorized access to payment infrastructure and customer financial data
• Supply chain risk: If the CLI is used in CI/CD pipelines on Windows build agents, a compromised directory could lead to code execution in build environments
• Compliance consequences: Organizations handling cardholder data (PCI-DSS scope) may face regulatory reporting requirements if payment data is compromised
• Limited blast radius: The attack requires local access and user interaction, reducing the likelihood of mass exploitation, but the user-context code execution can facilitate lateral movement once initial access is achieved

Affected Systems:

• Windows-based development workstations using Stripe CLI prior to version 1.7.13
• Windows CI/CD agents that invoke Stripe CLI commands
• Any Windows system where users might run stripe login, stripe config -e, stripe community, or stripe open from untrusted directories

The vulnerability does not affect macOS or Linux deployments, which significantly narrows the exposed population.

Detection Guidance

Sigma Rule

title: Stripe CLI Code Injection Attempt (CVE-2022-24753)
id: 2f8b8c6e-1a3e-4d5a-9f0e-7a2b3c4d5e6f
status: experimental
description: Detects execution of affected Stripe CLI commands from potentially attacker-controlled directories on Windows
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-24753
author: Valtersit Threat Intelligence
date: 2024/01/22
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\stripe.exe'
        CommandLine|contains:
            - 'login'
            - 'config -e'
            - 'community'
            - 'open'
    filter_known:
        CommandLine|contains:
            - '--help'
            - '--version'
    condition: selection and not filter_known
level: medium
falsepositives:
    - Legitimate Stripe CLI usage from trusted directories (validate directory path)
    - Stripe CLI updates or automated scripts invoking these commands from safe paths
fields:
    - CommandLine
    - CurrentDirectory
    - User
tags:
    - attack.t1204
    - attack.execution

YARA Rule

rule Stripe_CLI_Code_Injection_CVE_2022_24753 {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects suspicious files planted for exploitation of Stripe CLI code injection (CVE-2022-24753)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-24753"
        date = "2024-01-22"
        severity = "high"
    strings:
        $stripe_cmd1 = "stripe login" ascii wide nocase
        $stripe_cmd2 = "stripe config -e" ascii wide nocase
        $stripe_cmd3 = "stripe community" ascii wide nocase
        $stripe_cmd4 = "stripe open" ascii wide nocase
        $payload_hint1 = "cmd.exe /c" ascii wide nocase
        $payload_hint2 = "powershell -" ascii wide nocase
        $payload_hint3 = "WScript.Shell" ascii wide nocase
        $payload_hint4 = "ShellExecute" ascii wide nocase
    condition:
        any of ($stripe_cmd*) and any of ($payload_hint*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Stripe CLI Code Injection Attempt (CVE-2022-24753)";
content:"stripe"; content:"login"; content:"config"; content:"community"; content:"open";
pcre:"/(stripe\s+login|stripe\s+config\s+-e|stripe\s+community|stripe\s+open)/i";
reference:cve,2022-24753; classtype:attempted-user; sid:10024753; rev:1;)

Note: Network detection for this vulnerability is inherently limited because the vulnerable commands execute locally. This rule targets HTTP requests that may be part of exfiltration or staging attempts.