PT-2022-16856 · Stripe · Stripe Cli

Trungpabc · Published 2022-03-09 · Updated 2024-08-21 · CVE-2022-24753

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Stripe CLI versions prior to 1.7.13

Description A vulnerability exists in Stripe CLI on Windows when certain commands are run in a directory where an attacker has planted files. The affected commands are stripe login, stripe config -e, stripe community, and stripe open. MacOS and Linux are unaffected. An attacker who successfully exploits the issue can run arbitrary code in the context of the current user. The update addresses the issue by throwing an error in these situations before the code can run. There has been no evidence of exploitation of this issue.

Recommendations Upgrade to version 1.7.13. As a temporary workaround, consider avoiding running the affected commands in untrusted directories until the update is applied. Restrict access to the affected commands to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-24753

GHSA-4CX6-FJ7J-PJX9

GO-2022-0350

Affected Products

Stripe Cli

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24753.json · Exploit
• https://github.com/stripe/stripe-cli/commit/be38da5c0191adb77f661f769ffff2fbc7ddf6cd · Patch
• https://osv.dev/vulnerability/CVE-2022-24753 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0350 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4cx6-fj7j-pjx9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24753 · Security Note
• https://github.com/stripe/stripe-cli · Note
• https://github.com/stripe/stripe-cli/security/advisories/GHSA-4cx6-fj7j-pjx9 · Note
• https://t.me/cvenotify/27996 · Telegram Post