CVE-2021-21364: Local Information Disclosure Vulnerability in io.swagger:swagger-codegen
Summary
CVE-2021-21364: Generated Code Contains Local Information Disclosure Vulnerability. Affects io.swagger:swagger-codegen versions < 2.4.19. Fixed in 2.4.19. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.swagger:swagger-codegen package is a code generation tool that generates client libraries, server stubs, and API documentation from an OpenAPI Specification. It is widely used in the development of RESTful APIs. However, it is vulnerable to a local information disclosure vulnerability.
Vulnerability Detail
The vulnerability in io.swagger:swagger-codegen arises from the use of the File.createTempFile method from the JDK. This method creates a file inside the system temporary directory with insecure permissions (-rw-r--r--). As a result, the contents of this file can be viewed by all other users on the system. While this vulnerability is considered moderate in severity, it can lead to the exposure of sensitive information to unauthorized actors. The vulnerability has been assigned a CVSS score of 6.2.
How To Fix
Minimum fixed version
2.4.19
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the patched version is not immediately feasible, users can manually update the generated source code to use the java.nio.files.Files temporary file creation instead of java.io.File. This can be done by replacing instances of File.createTempFile with Files.createTempFile(prefix, suffix).toFile() or Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile().
Conclusion
The io.swagger:swagger-codegen package is vulnerable to a local information disclosure vulnerability. Users are advised to update to version 2.4.19 or later to fix the vulnerability. If immediate update is not possible, manual code changes can be made to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.swagger:swagger-codegen →
FAQ
The vulnerability allows for the disclosure of sensitive information to unauthorized actors. While it is considered moderate in severity, it can still pose a risk to the confidentiality of data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your pom.xml file and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, if updating to the patched version is not immediately feasible, you can manually update the generated source code to use the java.nio.files.Files temporary file creation instead of java.io.File. Refer to the 'workaround' section for the necessary code changes.
The CVSS score of this vulnerability is 6.2, indicating a moderate severity level.
For more information, you can refer to the original vulnerability report or contact the Swagger team at security@swagger.io.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.swagger:swagger-codegen.
