GHSA-q324-q795-2q5p Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Attackers can read arbitrary files via path traversal in openapi-cli preview-docs if local filenames contain question marks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-q324-q795-2q5p?
GHSA-q324-q795-2q5p is a path traversal vulnerability in @redocly/openapi-cli, published on 12 Oct 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Impact
preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name.
Patches
It was patched starting from 1.0.0-beta.59
Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark ? in name.
References
https://github.com/Redocly/openapi-cli/pull/347
For more information
If you have any questions or comments about this advisory:
- Open an issue in @redocly/openapi-cli
- Email us at [email protected]
Which versions are affected by GHSA-q324-q795-2q5p?
2 open source packages ship an affected version, including @redocly/openapi-cli.
| Package | Affected | Fixed in |
|---|---|---|
@redocly/openapi-cli npm | All versions | 1.0.0-beta.59 |
@redocly/openapi-cli npm | All versions | 1.0.0-beta.59 |
How do I fix GHSA-q324-q795-2q5p?
Upgrade @redocly/openapi-cli to 1.0.0-beta.59 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is GHSA-q324-q795-2q5p being exploited?
There is no known exploitation of GHSA-q324-q795-2q5p in the wild and no public exploit code.