CVE-2024-35219: 
Java vulnerability analysis and mitigation

OpenAPI Generator, a popular tool for generating API client libraries and server stubs, was found to contain a path traversal vulnerability (CVE-2024-35219) in versions prior to 7.6.0. The vulnerability was discovered in the online service component that allows users to generate code based on OpenAPI specifications. The issue was publicly disclosed on May 27, 2024, after being identified by a security researcher from SonarSource (Sonar Blog).

The vulnerability stems from improper handling of the 'outputFolder' option in the generator's online service. When users submit a request, they can specify an arbitrary output folder path through this option. The application fails to properly validate or sanitize this input, allowing for path traversal sequences (../../) to access directories outside the intended scope. The vulnerability has been assigned a CVSS v3.1 base score of 8.3 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, indicating network accessibility with low attack complexity (GitHub Advisory).

The vulnerability allows attackers to read and delete files and folders from any writable directory on the system where the OpenAPI Generator online service is running. This presents a significant security risk as it could lead to unauthorized access to sensitive files and potential data loss through malicious file deletion (GitHub Advisory, Sonar Blog).

The vulnerability can be exploited by sending a specially crafted request to the API endpoint with a manipulated 'outputFolder' parameter. The attack requires network access and low privileges, but no user interaction is needed. The vulnerability was discovered through taint analysis, which revealed a complex taint flow traversing 28 steps from the user input to the dangerous file operation (Sonar Blog).

The vulnerability has been fixed in OpenAPI Generator version 7.6.0 by completely removing the usage of the 'outputFolder' option. Users are strongly advised to upgrade to this version or later. No workarounds are available for users who cannot immediately upgrade (GitHub Advisory, GitHub PR).