PT-2024-39454 · Wiz+1 · Wiz Code Visual Studio Code Extension+2

Rohit Kumar + 1 · Published 2024-10-01 · Updated 2024-10-04 · CVE-2024-9145

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Wiz Code Visual Studio Code extension versions 1.0.0 through 1.5.3 Wiz (legacy) Visual Studio Code extension versions 0.13.0 through 0.17.8

Description The issue allows for local command injection when a user opens a maliciously crafted Dockerfile in a "trusted folder" within Visual Studio Code and initiates a manual scan of the file.

Recommendations For Wiz Code Visual Studio Code extension versions 1.0.0 through 1.5.3, update to a version outside of this range to resolve the issue. For Wiz (legacy) Visual Studio Code extension versions 0.13.0 through 0.17.8, update to a version outside of this range to resolve the issue. As a temporary workaround, consider avoiding the use of manual scans on Dockerfiles from untrusted sources until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-9145

Affected Products

Visual Studio Code

Wiz (Legacy) Visual Studio Code Extension

Wiz Code Visual Studio Code Extension

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-9145 · Security Note
• https://marketplace.visualstudio.com/items/WizCloud.wiz-vscode/changelog · Note
• https://wiz.io/security-advisories · Note
• https://t.me/cvedetector/6714 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1841103488949932094 · Twitter Post
• https://t.me/latest_high_impact_cve/1241 · Telegram Post
• https://twitter.com/CVEnew/status/1841020510253281527 · Twitter Post
• https://marketplace.visualstudio.com/items/WizCloud.wizcli-vscode/changelog · Note