Path traversal vulnerability in stripe-cli

高 7.1CVE-2024-45401 · GHSA-fv4g-gwpj-74gr · GO-2024-3119 · 05/09/2024 公開 · 17/06/2026 更新

要点

CVE-2024-45401 は github.com/stripe/stripe-cli, stripe cli (stripe) に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.21%（全脆弱性の 10.9% より高い）。
対処：1.21.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/stripe/stripe-cli Go	`≥ 1.11.1, < 1.21.3`	`1.21.3`
stripe cli stripe	`≥ 1.11.1, < 1.21.3`	`1.21.3`

概要

Impact

A vulnerability exists in stripe-cli versions 1.11.1 and higher where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files.

The update addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path.

There has been no evidence of exploitation of this vulnerability.

Recommendation

Upgrade to stripe-cli v1.21.3.

Acknowledgements

Thank you to 0xacb and bordiez for reporting this vulnerability.

For more information

Email us at [email protected]

NVD の説明

stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags can overwrite arbitrary files. The update in version 1.21.3 addresses the path traversal vulnerability by removing the ability to install plugins from an archive URL or path. There has been no evidence of exploitation of this vulnerability.