GHSA-58x9-vjvp-6mx8: Refitter: C# source injection through OpenAPI header parameter names
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in parameters[].name with in: header is emitted verbatim into a Refit [Header("<name>")] attribute string without escaping quotation marks. An attacker-influenced OpenAPI description can pass default validation without --skip-validation and break out from the parameter-list position by closing the parameter and method syntax, attribute, interface, and namespace. The generated file can remain valid C# while containing a top-level file class with a [ModuleInitializer] method, which executes attacker code when the compiled assembly is loaded at application startup, even if the client is never called. Query AliasAs and enum/default value sinks are escaped; this flaw is in header-name attribute-string emission. The behavior was verified with Refitter 2.0.0 and .NET 8. This issue is fixed in version 2.1.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Refitterto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Teams using Refitter to generate C# clients from OpenAPI descriptions that an attacker can influence are exposed. This includes descriptions that pass Refitter's normal default validation; use of --skip-validation is not required.
What must an attacker control to exploit it?
The attacker needs to influence a header parameter name in an OpenAPI document, specifically parameters[].name for a parameter whose location is header. A quotation mark in that name can escape the generated Refit Header attribute string and inject C# source.
Does the generated client need to make an API call for injected code to run?
No. The injected source can define a top-level class with a ModuleInitializer method, which runs when the compiled assembly is loaded at application startup even if the generated client is never called.
Which generated OpenAPI elements are implicated?
The vulnerable sink is header-name emission into the Refit [Header("<name>")] attribute. Query AliasAs values and enum/default value sinks are described as escaped and are not the issue covered here.
What version fixes the issue?
Upgrade Refitter to version 2.1.2, which fixes this issue. The vulnerable behavior was verified in Refitter 2.0.0 with .NET 8.