Junglewise Threat Intelligence

CVE-2016-1000249: apiaryio fury-adapter-swagger arbitrary file read via directory traversal

CVE-2016-1000249 · Severity: low · CVSS 3.1 · Published 2020-09-01

Vendors: npm.

Executive brief

fury-adapter-swagger is a tool used to parse Swagger 2.0 API definitions into a standardized format. A security flaw allows an attacker to provide a malicious API definition that forces the tool to read sensitive files from the underlying server, such as configuration files or system credentials. This could lead to the exposure of private data or cause the system to crash by attempting to read special system files that consume all available memory.

Technical details

fury-adapter-swagger (versions 0.2.0 through 0.9.6) is vulnerable to directory traversal and arbitrary file disclosure. The vulnerability exists because the parser improperly handles external references ($ref) within Swagger 2.0 JSON or YAML documents, allowing them to point to local file system paths. A remote attacker can provide a crafted Swagger document that, when parsed, dereferences local files (e.g., /etc/passwd) and includes their content in the output. Additionally, an attacker can cause a denial of service by referencing infinite data sources like /dev/zero. The issue is fixed in version 0.9.7 by preventing the dereferencing of external assets.

Affected products

  • apiaryio fury-adapter-swagger >= 0.2.0, < 0.9.7

Timeline

  • 2016-10-23: disclosed: Vulnerability reported by Adam Kliment and Honza Javorek.
  • 2016-10-25: patched: Fix merged in GitHub pull request #89.
  • 2020-09-01: advisory: GitHub Advisory published.

References