GHSA-4cx6-fj7j-pjx9

    Dashboard / Vulnerabilities / GHSA-4cx6-fj7j-pjx9

    GHSA-4cx6-fj7j-pjx9

    Published: 10 Mar 2022Last Modified: 21 Aug 2024

    Summary: Code injection in Stripe CLI on windows

    Details: ### Impact A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run. There has been no evidence of exploitation of this vulnerability. ### Recommendation Upgrade to Stripe CLI v1.7.13. ### Acknowledgments Thanks to [trungpabc](https://hackerone.com/trungpabc) for reporting the issue. ### For more information Email us at [[email protected]](mailto:[email protected]).

    References: https://github.com/stripe/stripe-cli/security/advisories/GHSA-4cx6-fj7j-pjx9, https://nvd.nist.gov/vuln/detail/CVE-2022-24753, https://github.com/stripe/stripe-cli/commit/be38da5c0191adb77f661f769ffff2fbc7ddf6cd, https://github.com/stripe/stripe-cli

    Affected packages

    Package

    Name: github.com/stripe/stripe-cli

    Purl: pkg:golang/github.com/stripe/stripe-cli

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -1.7.13

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High