在 OpenAPI-Generator 在线生成器中创建具有不安全权限的临时文件

The core of this vulnerability lies in how OpenAPI Generator Online handles temporary file creation. The File.createTempFile method, used to generate temporary directories, is susceptible to a race condition on Unix-like systems. Because temporary directories are often shared across users, a malicious user can observe the creation of a temporary subdirectory and then race to complete its creation. This allows the attacker to append code to the output folder, which, when executed, can be attacker-controlled. The impact is local privilege escalation; an attacker gains the ability to execute code with the privileges of the process running OpenAPI Generator Online, potentially compromising the entire system. This is particularly concerning in shared hosting environments or systems where the OpenAPI Generator Online process runs with elevated privileges.

Systems running OpenAPI Generator Online version 5.0.1 or earlier are at risk. This includes development environments, CI/CD pipelines that utilize OpenAPI Generator Online, and shared hosting environments where multiple users share the same temporary directory. Organizations using OpenAPI Generator Online to automatically generate API client code are particularly vulnerable.

• linux / server:

find /tmp -type f -mmin -5 -print0 | xargs -0 ls -l | grep -i 'openapi-generator'

• linux / server:

journalctl -f | grep "createTempFile"

• linux / server:

lsof /tmp | grep openapi-generator

1. 2021-05-11Disclosure

   disclosure

1. 已保留2020-12-22
2. 发布日期2021-05-11
3. 修改日期2026-03-13
4. EPSS 更新日期2026-04-02

The primary mitigation is to upgrade to OpenAPI Generator Online version 5.1.0 or later, which addresses the race condition. If an immediate upgrade is not possible, consider implementing a workaround by restricting access to the temporary directory used by OpenAPI Generator Online. This can be achieved through file system permissions, limiting which users can read, write, or execute files within that directory. Monitoring the creation and modification of files in the temporary directory can also help detect potential exploitation attempts. While not a direct fix, implementing robust input validation and sanitization can reduce the risk of malicious code being injected into the generated files. After upgrading, confirm the fix by attempting to create a temporary file and verifying that the attacker cannot manipulate its contents.