Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory

Vulnerability

Description

In swagger-codegen before version 2.4.19, the getTmpFolder() method on Unix-like systems creates a temporary subdirectory in the system's shared temporary directory using a race-prone sequence: File.createTempFile(), followed by delete() and mkdir(). This allows a collocated attacker to observe the temp file creation and race to create the expected subdirectory with attacker-controlled contents [1][2].

Exploitation

A local user with access to the shared temporary directory can monitor the creation of the temp file and intervene before the mkdir() call. By creating the subdirectory themselves, they can control its contents. When swagger-codegen later writes generated code to this directory, the attacker can influence the output [2].

Impact

Successful exploitation leads to local privilege escalation, as the attacker can inject arbitrary code into the outputFolder. If that code is later executed (e.g., as part of a build or server process), it runs under the context of the victim user, potentially compromising the system [1][2].

Mitigation

The vulnerability is fixed in swagger-codegen version 2.4.19. The fix replaces the vulnerable sequence with Files.createTempDirectory(), which atomically creates a secure temporary directory [2][3]. Users should update to 2.4.19 or later.