CVE-2023-27162: OpenAPI Generator vulnerable to Server-Side Request Forgery

March 31, 2023

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

References

openapi-generator.com/
gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08
github.com/OpenAPITools/openapi-generator
github.com/advisories/GHSA-wg4w-5m5r-w3p8
notes.sjtu.edu.cn/s/2_yki_2Xq
nvd.nist.gov/vuln/detail/CVE-2023-27162

Code Behaviors & Features

Detect and mitigate CVE-2023-27162 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →