Path Traversal Vulnerability in @redocly/openapi-cli
Summary
GHSA-q324-q795-2q5p: Path traversal when using preview-docs when working dir contains files with question mark ? in name. Affects @redocly/openapi-cli versions < 1.0.0-beta.59. Fixed in 1.0.0-beta.59. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @redocly/openapi-cli package is an open-source tool used for working with OpenAPI specifications. It provides various commands and functionalities to validate, lint, and preview OpenAPI documents. This package is widely used by developers and organizations to ensure the quality and consistency of their API documentation.
Vulnerability Detail
A path traversal vulnerability has been identified in the preview-docs command of the @redocly/openapi-cli package. This vulnerability allows an attacker to perform path traversal attacks if the current working directory contains files with a question mark '?' in their name. By exploiting this vulnerability, an attacker can access sensitive files outside of the intended directory, potentially leading to unauthorized access, information disclosure, or remote code execution.
How To Fix
Minimum fixed version
1.0.0-beta.59
This is the first release that contains the fix.
npm install @redocly/openapi-cli@1.0.0-beta.59Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update the @redocly/openapi-cli package, a temporary workaround is to avoid running the preview-docs command in a folder that contains files with a question mark '?' in their name. By ensuring that the working directory does not include such files, you can mitigate the risk of path traversal attacks.
Conclusion
The path traversal vulnerability in @redocly/openapi-cli can have serious security implications, allowing attackers to access sensitive files outside of the intended directory. It is crucial to update to the patched version or apply the recommended workaround to mitigate the risk. For further support and assistance in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for @redocly/openapi-cli →
FAQ
The path traversal vulnerability in @redocly/openapi-cli allows an attacker to access sensitive files outside of the intended directory. This can lead to unauthorized access, information disclosure, or remote code execution depending on the specific circumstances.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this path traversal vulnerability in @redocly/openapi-cli.
Yes, a temporary workaround is to avoid running the preview-docs command in a folder that contains files with a question mark '?' in their name. By ensuring that the working directory does not include such files, you can mitigate the risk of path traversal attacks.
Yes, the path traversal vulnerability in @redocly/openapi-cli has been patched starting from version 1.0.0-beta.59. It is recommended to update to this version or later to ensure the security of your application.
You can find more information about this vulnerability in the GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-q324-q795-2q5p/GHSA-q324-q795-2q5p.json. If you have any further questions or concerns, you can open an issue in the @redocly/openapi-cli repository or email security@redocly.com.
