github - ghsa-g3hr-p86p-593h

ghsa-g3hr-p86p-593h

Vulnerability from github

Published

2024-05-28 15:47

Modified

2024-05-28 15:47

Severity ?

8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Summary

OpenAPI Generator Online - Arbitrary File Read/Delete

Details

Impact

Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option.

Patches

The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the outputFolder option.

Workarounds

No workaround available.

References

No other reference available.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.openapitools:openapi-generator-online"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35219"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-28T15:47:57Z",
    "nvd_published_at": "2024-05-27T16:15:09Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAttackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option.\n\n### Patches\nThe issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release)  by removing the usage of the `outputFolder` option.\n\n### Workarounds\nNo workaround available.\n\n### References\nNo other reference available.",
  "id": "GHSA-g3hr-p86p-593h",
  "modified": "2024-05-28T15:47:57Z",
  "published": "2024-05-28T15:47:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35219"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenAPITools/openapi-generator/pull/18652"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenAPITools/openapi-generator"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenAPI Generator Online - Arbitrary File Read/Delete"
}

cve-2024-35219

Vulnerability from cvelistv5

Published

2024-05-27 16:11

Modified

2024-08-02 03:07

Severity ?

8.3 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Summary

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.

References

▼	URL	Tags
	https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h	x_refsource_CONFIRM
	https://github.com/OpenAPITools/openapi-generator/pull/18652	x_refsource_MISC
	https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

OpenAPITools

openapi-generator

Version: < 7.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openapitools:openapi-generator:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openapi-generator",
            "vendor": "openapitools",
            "versions": [
              {
                "lessThan": "7.6.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35219",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T16:27:13.509710Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T17:47:32.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:07:46.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h"
          },
          {
            "name": "https://github.com/OpenAPITools/openapi-generator/pull/18652",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/OpenAPITools/openapi-generator/pull/18652"
          },
          {
            "name": "https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openapi-generator",
          "vendor": "OpenAPITools",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-27T16:11:22.875Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h"
        },
        {
          "name": "https://github.com/OpenAPITools/openapi-generator/pull/18652",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenAPITools/openapi-generator/pull/18652"
        },
        {
          "name": "https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d"
        }
      ],
      "source": {
        "advisory": "GHSA-g3hr-p86p-593h",
        "discovery": "UNKNOWN"
      },
      "title": "OpenAPI Generator Online - Arbitrary File Read/Delete"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-35219",
    "datePublished": "2024-05-27T16:11:22.875Z",
    "dateReserved": "2024-05-14T15:39:41.783Z",
    "dateUpdated": "2024-08-02T03:07:46.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-g3hr-p86p-593h

Vulnerability from github

Impact

Patches

Workarounds

References

cve-2024-35219

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature