GHSA-657c-g7qc-r9j2: Path Traversal
Impact
An OpenAPI or AsyncAPI description could make the split command write files outside the chosen output directory, on the machine of anyone who runs split against it. The write is constrained rather than a free file-write primitive: component data is emitted only as YAML/JSON, and code-sample files are named after the HTTP method, so an attacker can place or overwrite files at an unintended path but has limited control over their name and contents.
Patches
Fixed in @redocly/cli v2.33.2.
Workarounds
Do not run the split command on API descriptions from untrusted or unreviewed sources.
To detect an exploit attempt, inspect the description's component names and x-codeSamples lang values for a literal ../ — neither legitimately contains path segments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@redocly/clito a version that resolves this vulnerability.Fixed in 2.33.2 - Upgrade
Upgrade
npm/@redocly/clito a version that resolves this vulnerability.Fixed in 1.34.17 - Upgrade
Upgrade
@redocly/clito a version that resolves this vulnerability.Fixed in 2.33.2 - Configuration
Only execute the `split` command on OpenAPI or AsyncAPI descriptions that are from trusted and reviewed sources.
redocly/cli split command usage policy = Do not run split on OpenAPI/AsyncAPI descriptions from untrusted or unreviewed sources - Compensating control
To detect exploit attempts, inspect the description's component names and run `split` against it (per the provided workaround instructions).
- Compensating control
Inspect `x-codeSamples` `lang` values for a literal `../`; ensure they do not contain `../` path traversal.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Anyone who runs the `split` command against an OpenAPI or AsyncAPI description supplied by an untrusted or unreviewed source is exposed. The issue affects the machine performing the split operation, not merely consumers of the resulting API description.
What must an attacker provide to exploit it?
An attacker needs to persuade someone to run `split` on a crafted API description. The malicious input uses a literal `../` in component names or in `x-codeSamples` `lang` values to cause output to be written outside the selected directory.
How severe is the file-write capability?
It is constrained rather than an unrestricted file-write primitive. Component output is limited to YAML or JSON, and code-sample filenames are based on the HTTP method, limiting attacker control over file names and contents.
What can be done if updating is not immediately possible?
Do not run `split` on API descriptions from untrusted or unreviewed sources. Before processing a description, inspect component names and `x-codeSamples` `lang` values for a literal `../`, which should not legitimately appear there.
What version contains the fix?
The issue is fixed in `@redocly/cli` version 2.33.2.