Swagger high-risk vulnerabilities affect Java, PHP, NodeJS, Ruby, and other languages

Swagger high-risk vulnerabilities affect Java, PHP, NodeJS, Ruby, and other languages

The widely used Swagger specification (renamed OpenAPI at the beginning of this year) found high-risk vulnerabilities that may affect applications developed in popular languages such as Java, PHP, NodeJS, and Ruby. This vulnerability allows attackers to remotely execute Code and exists in Swagger Code Generator. It is a parameter injection vulnerability that allows attackers to embed Code in Swagger JSON files, web applications developed using Java, PHP, NodeJS, Ruby, and other languages are affected if Swagger APIs are integrated. Rapid7 researchers disclosed the technical details and patches of the vulnerability, which was disclosed in private as early as April, but t Rapid7 said it did not hear a response from the Swagger maintainer.

This article permanently updates the link address: