CVE-2024-48964

What it actually does

Command injection triggered by improper handling of the current working directory name when the Snyk CLI scans an untrusted Gradle project, allowing arbitrary commands to execute in the context of the scan process.

Why it matters to the business

Organizations that scan untrusted or third-party Gradle projects risk full compromise of the scanning workstation or CI pipeline, potentially leading to credential theft, lateral movement, or supply-chain tampering; the issue affects any environment using the vulnerable Snyk Gradle plugin and requires immediate upgrade to restore safe scanning workflows.

How an attack unfolds

An attacker crafts a Gradle project directory whose name contains shell metacharacters or command sequences. When a victim runs 'snyk test' inside that directory, the snyk-gradle-plugin passes the directory name unsafely to a shell or build command, resulting in attacker-controlled code execution.

How to fix it

Upgrade the snyk-gradle-plugin to commit 2f5ee7579f00660282dd161a0b79690f4a9c865d (corresponding to Snyk CLI 1.1294.0 or later) and ensure all CI pipelines and developer workstations use the patched version. Until upgraded, restrict Snyk scans to projects from trusted sources only.

How to confirm the fix worked

Confirm the installed snyk-gradle-plugin version is at or above commit 2f5ee7579f00660282dd161a0b79690f4a9c865d; test by attempting to scan a directory whose name contains a benign command (e.g., 'echo vulnerable') and verify the command does not execute.

Typical attack path

1. Attacker creates a Gradle project folder with a malicious name containing command injection payload
2. Victim clones or downloads the project and runs 'snyk test' from inside the project directory
3. Snyk CLI invokes the vulnerable gradle-plugin which mishandles the working directory name
4. Injected commands execute with the privileges of the Snyk process
5. Attacker gains code execution, exfiltrates secrets, or installs persistence

How to detect it

Review Snyk execution logs, CI pipeline output, and shell history for unexpected command execution or processes spawned during Gradle scans; look for child processes whose parent is the Snyk CLI or gradle-plugin and whose command lines contain unusual characters or originate from non-standard project directories.

What your security team should do

• Immediately upgrade all Snyk CLI and gradle-plugin installations to the fixed commit
• Add a pre-scan policy that refuses to scan projects whose directory names contain shell metacharacters
• Audit CI logs for any historical use of Snyk against untrusted Gradle repositories
• Educate developers to never run Snyk inside directories obtained from untrusted sources