Executive brief
The preview-docs command in Redocly's OpenAPI CLI tool is a local documentation server used by developers to preview API documentation. A path traversal vulnerability allows an attacker to download arbitrary files from the server if the working directory contains files with question marks in their names, potentially exposing sensitive configuration files or other data.
Technical details
The vulnerability is a path traversal (CWE-22) in the preview server component that fails to properly strip query parameters from request URLs before processing file paths. When the working directory contains files with question marks (`?`) in their names, an attacker can craft a request like `http://localhost:8080/path?../../../../.redocly.yaml` to traverse outside the intended directory and access arbitrary files via `path.resolve()`. The attack requires knowledge of the filename containing the question mark and local or adjacent network access to the preview server. The fix, implemented in version 1.0.0-beta.59, strips query parameters from the request URL before path resolution.
Affected products
- Redocly openapi-cli >=1.0.0-beta.9, <1.0.0-beta.59
Timeline
- 2021-10-12: disclosed
- 2021-10-09: patched: Fix merged in PR #347; patch released in version 1.0.0-beta.59