GHSA-x6w4-f264-3vvr: Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion
Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the refitter dotnet tool invokes NJsonSchema with unsafe defaults for $ref resolution when generating Refit interfaces and contracts from attacker-controlled or attacker-influenced OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted remote schema content into generated output. Absolute local file paths and relative ../ traversal outside the input directory also resolve and inline local content, permitting arbitrary local-file disclosure. The demonstrated chain stops at server-side request forgery, remote file inclusion, and local file inclusion, not code execution: Refit sets the base URL at runtime, enum values use verbatim-string doubling, and string defaults are escaped. This issue is fixed in version 2.1.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
refitterto a version that resolves this vulnerability.Fixed in 2.1.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Developers and CI systems are exposed when they run the refitter dotnet tool on OpenAPI descriptions that an attacker controls or can influence. The vulnerable behavior is in build-time schema resolution, so the affected host is the developer or CI host running generation.
What does an attacker need to exploit it?
An attacker needs to supply or influence an OpenAPI description containing $ref values. Those references can point to remote HTTP(S) resources, absolute local file paths, or relative paths using ../ traversal outside the input directory.
What can exploitation do?
Remote references can make requests from the build host and inline remote schema content into generated output. Local references can resolve and inline arbitrary local file content; the demonstrated impact does not include code execution.
Are default settings affected?
Yes. Versions before 2.1.1 invoke NJsonSchema with unsafe defaults for $ref resolution, so no separate unsafe configuration is required.
What should teams do if they cannot upgrade immediately?
Do not run the tool on untrusted or attacker-influenced OpenAPI descriptions. Restrict inputs so that $ref values cannot reach remote URLs, absolute local paths, or traversal paths outside the intended input directory.