Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.OpenApi.Kiota | nuget | < 1.32.5 | 1.32.5 |
| Microsoft.OpenApi.Kiota.Builder | nuget | < 1.32.5 | 1.32.5 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the lack of sanitization for the clientClassName and clientNamespaceName properties, which can be provided via the x-ms-kiota-info OpenAPI extension or other configuration sources. An attacker could provide specially crafted values for these properties, containing path traversal sequences (../) or arbitrary code snippets. The Kiota tool would then use these unsanitized values to determine the output file path and to generate class and namespace declarations.
The analysis of the patch commit dc812dbbf88ef7edf53a890d36b2f9d1460e947d reveals that the fix involves introducing and applying sanitization functions at the points where these configuration values are read and processed. Specifically, the functions Kiota.Builder.LanguageInformation.Parse, Kiota.Builder.Configuration.GenerationConfiguration.UpdateConfigurationFromLanguagesInformation, and kiota.KiotaConfigurationExtensions.BindConfiguration were modified to use the new SanitizeClientClassName and SanitizeClientNamespaceName methods. These methods strip out characters that could be used for path traversal or code injection.
Therefore, the vulnerable functions are the ones that previously handled these configuration values without proper validation. During exploitation, a stack trace would likely show one of these functions processing the malicious input before it is used in file I/O operations or code generation, leading to the arbitrary file write or corrupted build.
Kiota.Builder.Configuration.GenerationConfiguration.UpdateConfigurationFromLanguagesInformationsrc/Kiota.Builder/Configuration/GenerationConfiguration.cs
Kiota.Builder.LanguageInformation.Parsesrc/Kiota.Builder/LanguageInformation.cs
kiota.KiotaConfigurationExtensions.BindConfigurationsrc/kiota/KiotaConfigurationExtensions.cs