CVE-2024-35219

HIGHNuclei

OpenAPI Generator Online - Arbitrary File Read/Delete

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-35219 has a selected CVSS score of 8.3 (high); EIP currently links 1 Nuclei template.

Description

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 5, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 28, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

OpenAPI Generator

Browse OpenAPITools / OpenAPI Generator

Default status: unknown

VulnCheck, CVE List< 7.6.0affected
Before 7.6.0affected

org.openapitools:openapi-generator-online

Browse Maven / org.openapitools:openapi-generator-online
GitHub AdvisoryBefore 7.6.0 · Fixed in 7.6.0affected

Nuclei templates

1
ProjectDiscoveryHIGHOpenAPI Generator <= 7.5.0 - Arbitrary File Read/DeleteCVSS 8.3

OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.

Impact

Authenticated attackers can read and delete arbitrary files and folders from writable directories.

Remediation

Update OpenAPI Generator to a version later than 7.5.0.

WeaknessesCWE-22
Authorsiamnoooob, rootxharsh, pdresearch
Template tagscvecve2024openapiintrusivelfivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
https://www.sonarsource.com/blog/the-power-of-taint-analysis-uncovering-critical-code-vulnerability-in-openapi-generator/ https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d https://github.com/OpenAPITools/openapi-generator/pull/18652 https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h https://nvd.nist.gov/vuln/detail/CVE-2024-35219

Source: ProjectDiscovery

References

5