Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2021-21430: Generated Java and Scala Code Contains Local Information Disclosure Vulnerability

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Using File.createTempFile in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. Affected generators: java (jersey2, okhttp-gson (default library)), scala-finch. The issue has been patched with Files.createTempFile and released in the v5.1.0 stable version.

CVE
#vulnerability#git#java#pdf

Impact

This vulnerability impacts generated code. If this code was generated as a one-off occasion, not as a part of an automated CI/CD process, this code will remain vulnerable until fixed manually!

On Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default umask settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions -rw-r–r-- and drwxr-xr-x respectively, unless an API that explicitly sets safe file permissions is used.

This vulnerability exists due to the use of the JDK method File.createTempFile. This method creates an insecure temporary files that can leave application and system data vulnerable to exposure.

Auto-generated code (Java, Scala) that deals with uploading or downloading binary data through API endpoints will create insecure temporary files during the process. For example, if the API endpoint returns a PDF file, the auto-generated clients will first download the PDF into a insecure temporary file that can be read by anyone on the system.

Affected generators:

  • Java

    • okhttp-gson (default library)

      if (tempFolderPath == null)

      return File.createTempFile(prefix, suffix);

      else

      return File.createTempFile(prefix, suffix, new File(tempFolderPath));

    • jersey2

      if (tempFolderPath == null)

      return File.createTempFile(prefix, suffix);

      else

      return File.createTempFile(prefix, suffix, new File(tempFolderPath));

    • resteasy

      if (tempFolderPath == null)

      return File.createTempFile(prefix, suffix);

      else

      return File.createTempFile(prefix, suffix, new File(tempFolderPath));

    • retrofit2

      @Override

      public File convert(ResponseBody value) throws IOException {

      File file = File.createTempFile("retrofit-file", “.tmp”);

      Files.write(Paths.get(file.getPath()), value.bytes());

      return file;

      }

  • Scala

    • scala-finch

      private def bytesToFile(input: Array[Byte]): java.io.File = {

      val file = File.createTempFile("tmp{{classname}}", null)

      val output = new FileOutputStream(file)

      output.write(input)

      file

      }

    • scala-akka

      val tempFileFromFileInfo: FileInfo => File = {

      file: FileInfo => File.createTempFile(file.fileName, “.tmp”)

      }

Patches

The issue has been patched by changing the generated code to use the JDK method Files.createTempFile and released in the v5.1.0 stable version.

References

#8787
#8791
#9348

This vulnerability has the same root cause as CVE-2021-21364 from the swagger-api/swagger-codegen project as this project and that one both share the same original source tree.
GHSA-hpv8-9rq5-hq7w

For more information

If you have any questions or comments about this advisory:

Related news

CVE-2023-33695: Temporary File Information Disclosure Vulnerability · Issue #3103 · dromara/hutool

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile() function at /core/io/FileUtil.java.

CVE-2022-4641: [SECURITY] Fix Temporary File Information Disclosure Vulnerability by JLLeitschuh · Pull Request #2 · tdunning/pig-vector

A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/apache/mahout/pig/LogisticRegression.java. The manipulation leads to insecure temporary file. The attack needs to be approached locally. The name of the patch is 1e7bd9fab5401a2df18d2eabd802adcf0dcf1f15. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216500.

CVE-2022-21126: [SECURITY] Fix Temporary Directory Hijacking or Information Disclosure Vulnerability by JLLeitschuh · Pull Request #1617 · samtools/htsjdk

The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.

CVE-2022-3952: [SECURITY] Fix Temporary Directory Hijacking or Information Disclosure Vulnerability by JLLeitschuh · Pull Request #580 · ManyDesigns/Portofino

A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability.

CVE-2021-21364: Generated Code Contains Local Information Disclosure Vulnerability

swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix-Like systems, the system temporary directory is shared between all local users. When files/directories are created, the default `umask` settings for the process are respected. As a result, by default, most processes/apis will create files/directories with the permissions `-rw-r--r--` and `drwxr-xr-x` respectively, unless an API that explicitly sets safe file permissions is used. Because this vulnerability impacts generated code, the generated code will remain vulnerable until fixed manually! This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21363.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907