CVE-2024-105796: Microsoft Kiota Code Injection via Doc-Comment Delimiter Reformation

Vulnerability Overview Vulnerability Name: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators Vulnerability Description: An attacker can control or tamper with OpenAPI descriptions, causing Kiota to generate Java or PHP source code under the attacker's control, thereby injecting malicious code into the generated code. Scope of Impact Affected Packages: - - Affected Versions: - : >= 0.5.0, = 0.5.0, < 1.35.0 Fixed Version: 1.35.0 Remediation Patch: Upgrade to Kiota 1.35.0 or higher and regenerate the affected clients. The fix involves neutralizing block comment delimiters rather than removing them, and performing Java delimiter neutralization after non-ASCII normalization. Workarounds: Before upgrading, generate clients only from trusted OpenAPI descriptions with integrity protection. Review the generated Java and PHP source code prior to compilation, loading, or deployment. Restrict permissions and secrets in the generation and build environments. Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2024-105796 Weakness: CWE-94 Credit: gavinbarron (Fix Developer) Related Advisories This vulnerability is distinct from PHP double-quoted string interpolation (GHSA-gxvh-520h-c92j) and CXML documentation line-break interruption (GHSA-3hrf-2qg2-mx2b). These fixes do not address the Java/PHP block comment delimiter reformatting issue. Code Blocks No POC code or exploit code available.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-105796: Microsoft Kiota Code Injection via Doc-Comment Delimiter Reformation

More from this source