Microsoft Kiota Pre-Auth SSRF & Local File Disclosure via Unrestricted $ref (CVE-2024-5867)

Vulnerability Overview Vulnerability Name: Generation-time SSRF + remote/local file inclusion via unrestricted Vulnerability ID: GHSA-r94h-fpcp-2qm8 Publication Date: 2 weeks ago Severity: High (7.1 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: Low - Availability: None Affected Scope Affected Versions: - Microsoft.OpenApi.Kiota (NuGet): < 1.32.5 - Microsoft.OpenApi.Kiota.Builder (NuGet): < 1.32.5 Vulnerability Types: - Build-time SSRF (CVE-918) - Arbitrary local file disclosure (CVE-22) - Uncontrolled remote content (CVE-829) Remediation Fixed Version: 1.32.5 or later Fix Details: - External reference resolution is now denied by default. - A new parameter allows loading external s under specific conditions. - When upgrading to Kiota 1.32.5 or later, external references require explicit enabling. Detailed Information Description: - Microsoft Kiota fetches URLs remotely and reads local files (including absolute/relative paths) to inline referenced schemas into generated clients. - Running when a specific points to an attacker-controlled internal URL or arbitrary local file results in SSRF, Remote File Inclusion (RFI), and Local File Inclusion (LFI). - Confirmed in versions 1.32.3 / 1.32.4. Details: - → The build host retrieves the URL (SSRF) and inlines the remote schema (RFI). - or → Kiota reads local files outside the expected tree and inlines their schema (LFI). - Kiota escapes its output pointers (comments/strings/identifiers), so attacker-controlled remote/local content cannot break out into the code. Impact: - Build-time SSRF targeting developers or CI hosts, arbitrary local file disclosure, and uncontrolled remote content. - If an attacker has full control over the description, they can trigger outbound requests from the build host to access cloud metadata, internal services, and read content that the attacker cannot access directly. Patch: - Fixed in version 1.32.5; external reference resolution is now denied by default. - A new parameter allows loading external s under specific conditions. Remediation Steps: - Upgrade to Kiota 1.32.5 or later; external references must be explicitly enabled. Additional Information CVE ID: CVE-2024-5867 Weaknesses: - CWE-22 - CWE-829 - CWE-918 Contributors: - GalNir (Reporter) - mostampoor (Reporter) - baywet (Remediation developer) - gwintbarron (Remediation reviewer) Code Block No POC code or exploitation code available.

Goal Reached Thanks to every supporter — we hit 100%!

Microsoft Kiota Pre-Auth SSRF & Local File Disclosure via Unrestricted $ref (CVE-2024-5867)

More from this source