CVE-2023-27162 OpenAPI Generator vulnerable to Server-Side Request Forgery
Attackers can exploit SSRF in openapi-generator to access internal network resources and sensitive information via crafted API requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27162?
CVE-2023-27162 is a critical server-side request forgery vulnerability in n/a, published on 31 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
Weakness: CWE-918
Which versions are affected by CVE-2023-27162?
2 open source packages ship an affected version, including org.openapitools:openapi-generator-project. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.openapitools:openapi-generator-project Maven | All versions to 6.4.0 | None |
org.openapitools:openapi-generator-project Maven | All versions to 6.4.0 | None |
Products include Openapi-Generator Openapi Generator.
How do I fix CVE-2023-27162?
No fix has been published for CVE-2023-27162 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-27162 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27162 exists.
Other vulnerabilities in n/a
- CVE-2021-21428 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
- CVE-2019-11405 OpenAPI Tools OpenAPI Generator uses HTTP in various files
- CVE-2021-21430 Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code
- CVE-2021-21429 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
Sources
Also known as GHSA-wg4w-5m5r-w3p8.