Executive brief
The AsyncAPI java-spring-cloud-stream-template is a code generator tool that creates Spring Cloud Stream application boilerplate from AsyncAPI specifications. An attacker can inject malicious Java code into generated application files by crafting a specially-designed AsyncAPI document, resulting in arbitrary code execution when the generated application is compiled and deployed. This allows complete compromise of applications using the vulnerable template.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the template generation engine. When processing an AsyncAPI document, the template tool does not properly sanitize the `operationId` field before embedding it into generated Java source code. An attacker can inject arbitrary Java code through a crafted AsyncAPI document supplied to the code generator command, which will be directly incorporated into the generated application. The attack requires the developer to run the vulnerable template tool against a malicious AsyncAPI document, but does not require authentication or network connectivity beyond command-line execution. The injected code executes with full application privileges during compilation or runtime. The vulnerability was patched in version 0.7.0.
Affected products
- AsyncAPI java-spring-cloud-stream-template <= 0.6.9
Timeline
- 2021-08-11: disclosed
- 2021-08-25: advisory
- 2021-08-25: patched: Fixed in version 0.7.0