PT-2021-24347 · Modelina · Modelina

Jonaslagoni · Published 2021-09-21 · Updated 2023-02-06 · CVE-2023-23619

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Modelina versions prior to 1.0.0

Description: Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. The maintainer's GitHub Security Advisory notes that it is impossible to fully guard against this issue, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are not seen as a security issue, but intended behavior.

Recommendations: For versions prior to 1.0.0, consider using fully custom presets that change the entire rendering process, which can then escape the user input. As of version 1.0.0, if you only access the constrained models, you will not encounter this issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-23619

GHSA-4JG2-84C2-PJ95

Affected Products

Modelina

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23619.json · Exploit
• 🔥 https://github.com/asyncapi/modelina/security/advisories/GHSA-4jg2-84c2-pj95 · Exploit
• https://osv.dev/vulnerability/GHSA-4jg2-84c2-pj95 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23619 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23619 · Vendor Advisory
• https://github.com/asyncapi/modelina · Note
• https://t.me/cibsecurity/56971 · Telegram Post