GHSA-3fhm-p725-h3g3: Refitter: C# source injection through OpenAPI path keys
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI paths-object keys are emitted verbatim into Refit route attributes such as [Get("<path>")] without escaping quotation marks or restricting characters. An attacker-influenced single-line, slash-prefixed path survives default validation without --skip-validation and can close the attribute string, interface, and namespace while introducing a top-level file class and reopening the generated structure to keep valid C#. A [ModuleInitializer] method executes attacker code when an application compiles and loads the generated assembly at startup, even without calling the generated client. The enum and default value sinks are escaped and are not the vulnerable path-emission sink. The behavior was verified on Refitter 2.0.0 with .NET 8. This issue is fixed in version 2.1.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Refitterto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations are exposed if they use Refitter before 2.1.2 to generate C# clients from an attacker-influenced OpenAPI document. The malicious input is an OpenAPI paths-object key, so exposure depends on whether untrusted or insufficiently reviewed specifications can reach the generation workflow.
Does exploitation require bypassing Refitter validation or use of --skip-validation?
No. A single-line, slash-prefixed malicious path can survive the default validation behavior, so exploitation does not require --skip-validation.
When does injected code execute?
Injected code can execute when the application compiles and loads the generated assembly at startup through a ModuleInitializer method. The generated client does not need to be called.
What versions should be remediated?
Update Refitter to version 2.1.2, which fixes the issue. The vulnerable behavior was verified on Refitter 2.0.0 with .NET 8, and the advisory states that versions prior to 2.1.2 are affected.
Which OpenAPI fields are relevant when reviewing generated code?
Review generated route attributes derived from OpenAPI paths-object keys, especially for unescaped quotation marks or unexpected characters. Enum and default-value sinks are escaped and are not the vulnerable path-emission sink described here.