Executive brief
AsyncAPI Modelina is a code generation library used to automatically create type-safe models from API schemas (AsyncAPI, OpenAPI, JSON Schema). An attacker can inject arbitrary code into the generated TypeScript, JavaScript, or other language output by crafting malicious schema properties. This could lead to remote code execution when generated code is compiled and executed, compromising applications that use generated models from untrusted sources.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the default rendering presets of @asyncapi/modelina versions before 1.0.0. The library fails to properly escape or sanitize user-supplied input from API schema documents (properties, identifiers, etc.) when generating code. An attacker can embed arbitrary code fragments in schema property names or other input fields; when the generator processes these schemas, the malicious code is directly embedded into the generated output without sanitization. For example, a property name like "property: any; \n constructor(){console.log('injected')} \n private _temp" will inject arbitrary statements into the generated class definition. The attack requires providing a malicious schema to the generator; no authentication or user interaction is required beyond supplying the schema. This affects anyone using default presets or custom presets that do not explicitly escape user input. The patch in version 1.0.0 addresses this by introducing constrained models that sanitize output, though the advisory notes that custom presets without proper escaping remain vulnerable.
Affected products
- AsyncAPI @asyncapi/modelina <1.0.0
Timeline
- 2021-09-21: disclosed
- 2021-09-21: patched: Version 1.0.0 released with patch using constrained models