Vulnerability · Published May 27, 2024 · Assigned by GitHub_M
CVE-2024-35219OpenAPI Generator Online - Arbitrary File Read/Delete
High 8.3
In plain English
A high-severity path traversal in openapi-generator from OpenAPITools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.openapitools:openapi-generator-online | 7.6.0 | GHSA-g3hr-p86p-593h |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenAPITools | openapi-generator | < 7.6.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
References
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h x_refsource_CONFIRM
- https://github.com/OpenAPITools/openapi-generator/pull/18652 x_refsource_MISC
- https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d x_refsource_MISC