CVE-2020-15141

Openapi-python-client < 0.5.3 allows malicious files anywhere on disk

• CVSS 4.1
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• Input Validation and Sanitization
• Local

In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

CVE

CVE-2020-15141

CWE

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSS base score

4.1

Published

2020-08-14

OWASP

A10 Server Side Request Forgery (SSRF)

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Upgrade to openapi-python-client version 0.5.3 or higher.

import os

def generate_client(base_path, filename):
    file_path = os.path.join(base_path, filename)
    
    with open(file_path, 'w') as f:
        f.write("# Client code generated here")

import os
import re

def join(base_path, user_input):
    normalized_path = os.path.normpath(user_input)
    if not normalized_path.startswith(os.path.normpath(base_path)):
        raise ValueError("Attempted path traversal detected!")
    return normalized_path

def generate_client(base_path, filename):
    file_path = join(base_path, filename)
    
    with open(file_path, 'w') as f:
        f.write("# Client code generated here")

@misc{vaitp:cve202015141,
  title        = {{Openapi-python-client < 0.5.3 allows malicious files anywhere on disk}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-15141},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-15141/}}
}