CVE-2017-1000208

HIGH

Swagger-Parser <= 1.0.30 and Swagger-Codegen <= 2.2.2 - Remote Code Execution via YAML Parsing

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2017-1000208. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository contains a vulnerable version of the Swagger Parser library, specifically targeting CVE-2017-1000208, which involves a deserialization vulnerability. The provided code includes the full source of the vulnerable library, allowing for exploitation testing and analysis.

Description

A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.

Exploits (2)

nomisec WORKING POC
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2017-1000208-swagger-parser-vulnerable

This repository contains a vulnerable version of the Swagger Parser library, specifically targeting CVE-2017-1000208, which involves a deserialization vulnerability. The provided code includes the full source of the vulnerable library, allowing for exploitation testing and analysis.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Swagger Parser (swagger-compat-spec-parser) version 1.0.24
No auth needed
Prerequisites: Java 1.7 or later · Apache Maven 3.0.3 or greater
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec WORKING POC
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2017-1000208-swagger-parser-vulnerable

This repository contains a vulnerable version of the Swagger Parser library, specifically targeting CVE-2017-1000208. The code includes the necessary Java classes and configurations to demonstrate the vulnerability, which involves deserialization issues in the Swagger Parser.

Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target: Swagger Parser 1.0.24
No auth needed
Prerequisites: Java 1.7 or higher · Apache Maven 3.0.3 or greater
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.8
EPSS 0.0046
EPSS Percentile 64.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (4)
io.swagger/swagger-codegen 0 - 2.2.2Maven
io.swagger/swagger-parser 0 - 1.0.31Maven
swagger/swagger-codegen < 2.2.2
swagger/swagger-parser < 1.0.30
Published Nov 17, 2017
Tracked Since Feb 18, 2026