Race Condition Affecting org.openapitools:openapi-generator-online package, versions [,5.1.0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGOPENAPITOOLS-1290614
- published 11 May 2021
- disclosed 11 May 2021
- credit Jonathan Leitschuh
How to fix?
Upgrade org.openapitools:openapi-generator-online to version 5.1.0 or higher.
Overview
org.openapitools:openapi-generator-online is an a Spring Boot Server application which hosts a client/server generator API.
Affected versions of this package are vulnerable to Race Condition. The contents of the outputFolder can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled.
openapi-generator-online creates insecure temporary folders with the File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system.
This is due to a race condition between the deletion of the randomly generated temporary file and the creation of the temporary directory.