CVE-2024-35219
📋 TL;DR
OpenAPI Generator versions before 7.6.0 contain a path traversal vulnerability that allows attackers to read and delete files from arbitrary writable directories. This occurs because anyone can specify the output folder via the 'outputFolder' option when submitting generation requests. Organizations using vulnerable versions of OpenAPI Generator for API client or server stub generation are affected.
💻 Affected Systems
- OpenAPI Generator
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the server hosting OpenAPI Generator, allowing attackers to delete critical system files, read sensitive configuration files, or potentially achieve remote code execution by manipulating files.
Likely Case
Unauthorized file access and deletion within the application's context, potentially exposing API specifications, configuration files, or other sensitive data stored in writable directories.
If Mitigated
Limited impact if the application runs with minimal permissions and file system access is properly restricted, though the vulnerability still exists.
🎯 Exploit Status
The vulnerability requires no authentication and exploitation is straightforward by manipulating the outputFolder parameter with path traversal sequences like '../../'.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.6.0
Vendor Advisory: https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
Restart Required: Yes
Instructions:
1. Stop the OpenAPI Generator service. 2. Update to version 7.6.0 or later using your package manager or by downloading from the official repository. 3. Restart the service. 4. Verify the fix by checking the version and testing that the outputFolder parameter is no longer accepted.
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states no known workarounds exist. The vulnerability is in the core functionality and requires patching.
🧯 If You Can't Patch
- Disable or restrict access to the OpenAPI Generator service entirely, especially if internet-facing.
- Implement strict network segmentation and access controls to limit which users or systems can interact with the vulnerable service.
🔍 How to Verify
Check if Vulnerable:
Check if your OpenAPI Generator version is below 7.6.0 by running 'openapi-generator version' or inspecting your deployment configuration.Check Version:
openapi-generator versionVerify Fix Applied:
After updating, confirm the version is 7.6.0 or higher and test that attempts to use the outputFolder parameter with path traversal sequences (e.g., '../../etc/passwd') are rejected or ignored.📡 Detection & Monitoring
Log Indicators:
- Log entries showing file operations outside expected directories
- Requests containing path traversal sequences in the outputFolder parameter
- Error messages related to file access permissions or invalid paths
Network Indicators:
- Unusual patterns of requests to the OpenAPI Generator endpoint, especially with parameters containing '../' sequences
SIEM Query:
source="openapi-generator" AND (message="*outputFolder*" OR message="*../*")🔗 References
- https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
- https://github.com/OpenAPITools/openapi-generator/pull/18652
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
- https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
- https://github.com/OpenAPITools/openapi-generator/pull/18652
- https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
