CVE-2021-21428 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator

What is CVE-2021-21428?

CVE-2021-21428 is a critical vulnerability in OpenAPITools openapi-generator, published on 10 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. openapi-generator-online creates insecure temporary folders with File.createTempFile during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system. The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

Weakness: CWE-668, CWE-269

Which versions are affected by CVE-2021-21428?

2 open source packages ship an affected version, including org.openapitools:openapi-generator-online. It affects 1 product.

Products include Openapi-Generator Openapi Generator.

How do I fix CVE-2021-21428?

Upgrade org.openapitools:openapi-generator-online to 5.1.0 or later.

Is CVE-2021-21428 being exploited?

There is no known exploitation of CVE-2021-21428 in the wild and no public exploit code.

Other vulnerabilities in OpenAPITools openapi-generator

• CVE-2023-27162 OpenAPI Generator vulnerable to Server-Side Request Forgery Critical 9.1
• CVE-2019-11405 OpenAPI Tools OpenAPI Generator uses HTTP in various files High 8.1
• CVE-2021-21430 Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code Medium 6.2
• CVE-2021-21429 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin Medium 4.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-23x4-m842-fmwf.