CVE-2024-45401 stripe-cli Path Traversal vulnerability
A path traversal flaw in Stripe CLI allows arbitrary file overwrites via malicious plugin archives, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-45401?
CVE-2024-45401 is a high-severity path traversal vulnerability in stripe-cli, published on 5 Sep 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files. The update in version 1.21.3 addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2024-45401?
3 open source packages ship an affected version, including github.com/stripe/stripe-cli. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/stripe/stripe-cli Go | From 1.11.1 | 1.21.3 |
github.com/stripe/stripe-cli Go | From 1.11.1 | 1.21.3 |
github.com/stripe/stripe-cli Go | From 1.11.1 | 1.21.3 |
Products include Stripe Stripe Cli.
How do I fix CVE-2024-45401?
Upgrade github.com/stripe/stripe-cli to 1.21.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-45401 being exploited?
There is no known exploitation of CVE-2024-45401 in the wild and no public exploit code.
Other vulnerabilities in stripe-cli
Sources
Also known as GHSA-fv4g-gwpj-74gr, GO-2024-3119.