Nixpkgs security tracker
7.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): Required (R)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): Low (L)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): Required (R)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): Low (L)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.
References
-
https://github.com/microsoft/kiota/security/advisories/GHSA-rg4h-fpcp-2qm8 x_refsource_CONFIRM
-
https://github.com/microsoft/kiota/pull/7888 x_refsource_MISC
-
https://github.com/microsoft/kiota/releases/tag/v1.32.5 x_refsource_MISC
Affected products
- ==< 1.32.5
Matching in nixpkgs
pkgs.python313Packages.microsoft-kiota-http
HTTP request adapter implementation for Kiota clients for Python
pkgs.python314Packages.microsoft-kiota-http
HTTP request adapter implementation for Kiota clients for Python
pkgs.python313Packages.microsoft-kiota-abstractions
Abstractions library for Kiota generated Python clients
pkgs.python314Packages.microsoft-kiota-abstractions
Abstractions library for Kiota generated Python clients
pkgs.python313Packages.microsoft-kiota-serialization-form
Form serialization implementation for Kiota clients in Python
pkgs.python313Packages.microsoft-kiota-serialization-json
JSON serialization implementation for Kiota clients in Python
pkgs.python313Packages.microsoft-kiota-serialization-text
Text serialization implementation for Kiota generated clients in Python
pkgs.python314Packages.microsoft-kiota-serialization-form
Form serialization implementation for Kiota clients in Python
pkgs.python314Packages.microsoft-kiota-serialization-json
JSON serialization implementation for Kiota clients in Python
pkgs.python314Packages.microsoft-kiota-serialization-text
Text serialization implementation for Kiota generated clients in Python
pkgs.python313Packages.microsoft-kiota-authentication-azure
Kiota Azure authentication provider
pkgs.python314Packages.microsoft-kiota-authentication-azure
Kiota Azure authentication provider
pkgs.python313Packages.microsoft-kiota-serialization-multipart
Multipart serialization implementation for Kiota clients in Python
Package maintainers
-
@fabaff Fabian Affolter <mail@fabian-affolter.ch>