Java, PHP, NodeJS, and Ruby Tools Compromised By Severe Swagger Vulnerability (threatpost.com) 97
"Researchers have discovered a vulnerability within the Swagger specification which may place tools based on NodeJS, PHP, Ruby, and Java at risk of exploit," warns ZDNet's blog Zero Day, adding "the severe flaw allows attackers to remotely execute code." Slashdot reader msm1267 writes:
A serious parameter injection vulnerability exists in the Swagger Code Generator that could allow an attacker to embed executable code in a Swagger JSON file. The flaw affects NodeJS, Ruby, PHP, Java and likely other programming languages. Researchers at Rapid7 who found the flaw disclosed details...as well as a Metasploit module and a proposed patch for the specification. The matter was privately disclosed in April, but Rapid7 said it never heard a response from Swagger's maintainers.
Swagger produces and consumes RESTful web services APIs; Swagger docs can be consumed to automatically generate client-server code. As of January 1, the Swagger specification was donated to the Open API Initiative and became the foundation for the OpenAPI Specification. The vulnerability lies in the Swagger Code Generator, and specifically in that parsers for Swagger documents (written in JSON) don't properly sanitize input. Therefore, an attacker can abuse a developer's trust in Swagger to include executable code that will run once it's in the development environment.
Swagger produces and consumes RESTful web services APIs; Swagger docs can be consumed to automatically generate client-server code. As of January 1, the Swagger specification was donated to the Open API Initiative and became the foundation for the OpenAPI Specification. The vulnerability lies in the Swagger Code Generator, and specifically in that parsers for Swagger documents (written in JSON) don't properly sanitize input. Therefore, an attacker can abuse a developer's trust in Swagger to include executable code that will run once it's in the development environment.
Re:Would Rust have prevented this? (Score:4, Informative)
From my fairly basic reading of the issue, it is NOT a problem of ANY of the listed languages, but a problem with using/integrating the Swagger API in your web app using any language.
Re: (Score:2)
Re: (Score:3)
Have you heard of von neumann architectures? Did you know that nearly every computer in use today is such a device?
Re: That's what you get for using OSS (Score:1)
Save this as a batch file and modify or re-write it for your environment.
Usage:
instructionstocash takes instructions from stdin and outouts the literal string "cash!" to stdout.
--cut here--
#!/bin/sh
#instuctionstocash
echo 'cash!'
--cut here--
Re: That's what you get for using OSS (Score:1)
Damn typos. Finding and fixing typos is left as an exercise for the reader.
Re: (Score:2)
Re: (Score:2)
Now I'm confused. Should we use Windows 7, or should we use hot grits?
Never heard of it (Score:1)
Never heard of it and not in use in major areas. Nothing to see here. Just overhyped.
Re: (Score:2)
Re: (Score:2)
I think swagger is like WSDL using json instead of xml
Re: (Score:2)
Seconding this... NEVER heard of Swagger before... At first I thought that was the new hip name FOR this exploit (WHY THE FUCK DO THEY ALL NEED NAMES NOW)
Re: (Score:2)
Re: (Score:1)
I have never heard of it either,
Looks like another one of those new trendy things that let people who cant program think they can program.
- Just type blipetyblop., and you will have a complete system up and running.
- Oh cool, my boss will be pleased!
- Now type blippty-format-c-blop
- Okidoki...
Oh no, turns out the blipetyblop-framework has a vulnerability!
Web Programmers Gonna Web (Score:1)
was it intended to be secure? (Score:5, Informative)
I hadn't see Swagger before, but it looks like a nicer design than previous web service description languages.
The "vulnerability" related to Swagger in some tools that the REST API specification (in Swagger format) into a library that talks to that API. Specifically, malicious specifications can inject code into the library. I don't think this is a major problem in practice. These translation tools are invoked by people who want to write clients for specific services; usually, that means that you know the service provider and understand your trust relationship. In addition, this is not a fully automatic process, since you'll be programming against the library that the tool generates anyway.
Keep in mind that the alternative to a REST specification that the service provider gives you a bunch of REST client libraries, and it's far easier to hide malicious code in those client libraries than in a REST specification.
I don't think it's fair to call this a significant "vulnerability", although it might still be nice if Swagger tools detected these cases and alerted the developer to it.
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:3)
Re: (Score:1)
REST and security are orthogonal concerns (Score:2)
"The fundamental problem with RPC is coupling. RPC clients become tightly coupled to service implementation in several ways and it becomes very hard to change service implementation without breaking clients"
Which is why RESTful HTTP isn't RPC, because we already know it's the wrong tool for this job. The fundamental problem is that today's web has an entire programming cult[ure] raised on OOP to the point where they're pathologically incapable of imagining any kind of interaction model except synchronous local message passing, so instead of bothering to RTFM until they understand correctly how REST works, the lazy toads simply reinterpret "REST" to mean what they already know. Which is 180 the opposite to what
Re: (Score:1)
REST isn't a mess, it's actually a very clean, logical, and elegant state-centric approach to interconnecting vast numbers of highly heterogenous state machines. It's the entire web programming "profession"'s atrocious inability to get what REST actually means, as to what they reinterpret it to mean, to the point where their total misconceptions are now raised to the status of "industry standard".
Protip: Any software developer who uses the phrase "REST API" has a deep detailed technical understanding of R
Re: (Score:1)
Re: (Score:1)
https://developers.slashdot.or... [slashdot.org]
https://developers.slashdot.or... [slashdot.org]
https://developers.slashdot.or... [slashdot.org]
https://developers.slashdot.or... [slashdot.org]
Doesn't cover all the philosophy or mechanics, but should do for starters. Ask specific questions where more information is needed.
Oh, and Fielding's writeup from his work on HTTP, natch:
https://www.ics.uci.edu/~field... [uci.edu]
All good on the theory, hopeless on worked examples for actually testing if your interpretation actually matches his intent, but guess that's how academia rolls
Re: (Score:2)
Re: (Score:3, Insightful)
Well I must misunderstand REST then!
Very likely. It's not about "APIs"; never has been. The web was original designed to be a vastly distributed document publishing system, where everyone could read and everyone could write. The first "web browser" was actually a WYSIWYG editor, kinda like Word except that instead of opening and saving documents on your local drive it opened and saved them across the internet. HTTP was the transport mechanism for that, and crucially it made no statements on what those documents were or how they were encoded;
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re:was it intended to be secure? (Score:5, Interesting)
Swagger is nice but it is a workaround for what is really a mess: REST. HTTP was not intended to be used an an application level API, nor were XML or JSON. These are all bastard approaches.
This is (a) a matter of opinion and (b) completely irrelevant to the bug in question, which is a problem with input sanitation which is a perennial source of security bugs recognized as far back as 1974 in the first edition of Elements of Programming Style.
Now as to the bastard-y of HTML as an API -- having actually read RFC 2616 myself and implemented some of it in raw TCP sockets for some very early mobile to server data connections, I beg to differ. REST is precisely what HTTP was designed to do. People who didn't read the RFCs simply went with what seemed simplest to them, which by in large was using GET and PUT interchangeably since they seemed to be just two ways of doing the same thing. That was very common practice in 2000 when Roy Fielding wrote his famous doctoral dissertation, the arguably most significant contribution of which is simply pointing out what had been the intended semantics of HTTP all along.
Having tried my hand at SOAP and XML-RPC, I can also say why REST over JSON has been so successful: they make the programmer's job easier, which is what architecture is supposed to do.
"Architecture" has almost become a synonym for making things awkward and unnecessarily complicated, but what good architecture does is separate concerns so you don't have to deal with overwhelming amounts of detail at once. Of course good architecture has never stopped anyone from bolluxing themselves up and handing a steaming pile of logic turds over to someone else.
Re: (Score:2)
You read a modern spec? stop the presses.
Seriously, what HTTP was designed to do is described here https://tools.ietf.org/html/rf... [ietf.org]
Read that one and you'll understand why people think REST is almost silly.
Re: (Score:2)
Re: (Score:2)
CORBA came out in 1991 and SunRPC in 1988. REST didn't arrive until 2000. So, the history of this is that people tried to make CORBA and RPC (and Microsoft's versions of the same) work for about a decade before they gave up and switched to REST.
CORBA's and gRPC's IDLs a
Re: (Score:2)
Re: (Score:2)
gRPC and REST don't even solve the same problem. Google is using RPC extensively, but mainly in the context of their own internal distributed systems, with an army of testers and developers, massive integration testing, and a single codebase. REST is for highly heterogeneous systems, languages, developer skills, a huge range of latencies, and numerous failure and security models. RPC can be a useful tool for the kinds of distributed systems Google is building to support their services; it is not a good tool
Re: (Score:2)
Re: (Score:2)
Google hasn't "turned away" from anything, Google never embraced REST or dynamic languages much in the first place. Google has always been a stodgy C++/Java shop, and they can get away with using such unproductive tools because they have gobs of money and tens of thousands of programmers. I'm not sure where you work, so it may come as a su
Re: (Score:2)
Re: (Score:2)
They do. But that doesn't mean that you do. What works for Google (or the DOD, or IBM) doesn't work for most other companies, projects, or programmers, because they operate under a completely different set of constraints.
I suggest you read the entire interview [acm.org], because Alan Kay was
Re: (Score:2)
"What works for Google (or the DOD, or IBM) doesn't work for most other companies, projects, or programmers, because they operate under a completely different set of constraints." - that is VERY true.
I agree that C++ is too complex. The problem is, alternatives are even worse for other reasons. Ruby is HORRIBLE from maintainability and performance points of view. To write maintainable Ruby, one has to use TDD, which is deeply incompatible with how many people think. (See the debates between David Heinemeyer
Re: (Score:2)
I didn't really voice an opinion on the merits of C++ either way. You had said that "of late, Google has turn[ed] away from several current cherished paradigms", implying that there is some kind of repudiation of dynamic languages going on. I just pointed out that Google never was much into dynamic languages in the first place, and that just because C++ is a good choice for Google's core applications doesn't mean it's a good choice for most programmers. As a C++ programmer myself, I think it's great that Go
Re: (Score:2)
Re: (Score:2)
I think your premises are flawed. Google uses a mix of C++, Python, Java, JavaScript, and Go, and all of those languages support both static and dynamic type checking. And Google clearly isn't happy with C++, otherwise they wouldn't have hired someone to develop Go. Furthermore, Go has substantially weaker static type checking than C++, so it doesn't look like Google is as adamant about static typing as you seem to be
Re: (Score:2)
Re: (Score:2)
Type safety isn't the same as typing strategy. C++'s type safety is weaker than Go's (since there are types like "void *"), but it has a more expressive static type system.
I think you're overgeneralizing from your limited experience with a tool-poor scripting language to dynamic langua
Re: (Score:2)
"limited experience with a tool-poor scripting language..." - which are you referring to, Ruby? If so, Ruby is not tool-poor.
"...but in return, a lot of problems become quite a bit easier to solve." - Yes, I agree with you. Perhaps our disagreement is our perspective: I advise organizations, and so I tend to be on the side of maintainability - and that requires languages and tools that are naturally maintainable - not ones that require great effort to craft maintainability. I think that you advocate for the
Re: (Score:2)
Scripting languages and dynamic languages are not the same thing. Ruby is a scripting language and really doesn't have a lot of the tools that exist for a heavy duty dynamic language like, say, Smalltalk.
People can easily create completely unmaintainable code in C++ or Haskell. Static typing is neither necessary nor sufficient fo
Re: (Score:2)
Re: (Score:2)
Protocol buffers have a couple of serious problems. First, they are not designed for large messages (>1Mbyte); so forget about using them for things like audio, video, image, or document upload... like most of what people actually do with REST. That limitation goes to the core of their APIs, which don't support incremental decoding or non-copy memory transfers very well. Pro
Re: (Score:2)
"not designed for large messages...": Hmmm - isn't there a way to attach a file - i.e., a MIME "part"? Since PB uses HTTP2, it would be hard for me to imagine that they left that out. But if you are right, I agree it would be a terrible problem. Perhaps attaching files is part of gRPC but not PB?
Not sure I understand your comment about non-copy memory transfers, since PB/gRPC are remote (out-of-process) communication tools.
Yes, you are right, that message passing (e.g., UDP) is more scalable when one has a
Re: (Score:2)
Not that I know of. And what would be the point? That would amount to a REST call with metadata attached in PB format, which is kind of like a bicycle for fish.
Re: (Score:2)
"Not that I know of. And what would be the point? That would amount to a REST call with metadata attached in PB format, which is kind of like a bicycle for fish." - that would indeed be ridiculous, but I would expect the attached binary content to be unencoded, as it is in an HTTP binary encoded part. There is a major use case for that: queries that send binary data. E.g., I have been using the docker engine and docker registry REST APIs, and many of the methods include both query parameters and binary obje
Re: (Score:2)
Be my guest. I'm just telling you don't hold your breath for gRPC to take off.
No, I'm sorry, but you still don't understand. Asynchronous message passing is a programming language abstraction, not a network abstraction; it's what Alan Kay originally envisioned for Smalltalk methods.
Re: (Score:2)
Re: (Score:2)
http://www.grpc.io/docs/tutori... [www.grpc.io]
Note that the API still requires requests and responses, so it forces clients and servers to keep track of state even if the computation otherwise doesn't require it. That's because procedure calls are an abstraction that intrinsically involves a notion of state.
In a message passing architecture, the primitive by which you invoke functionality on obje
Re: (Score:2)
Aha. Now I know where the disconnect is in our discussion on this. I have been thinking in terms of updates, and you have been (it sounds like) been thinking in terms of fetching data. Yes, for fetching data, you are right, asynchronous is far more efficient, if one can get away with a best effort (eventual consistency) approach, which is usually the case for UIs.
For transactions that do updates, a synchronous approach is far easier to implement, because one does not have to keep track of application state,
Re: (Score:2)
Swagger Codegen is a pile of crap (Score:1)
Been there, done that, got the scars to prove it.
I've found that compared to the tooling we were all using 15 years ago to build SOAP web services (fond memories of fighting incompatible implementations...), Swagger tooling is far worse, implements far fewer even obvious use cases, and is laden with bugs. In my recent work, Swagger Codegen was the worst I used. It is a flaming piece of shit which appears to be maintained by the same sort of teenagers with short attention spans that brought you crap like "le
Wetware still wet (Score:1)
So the vulnerability, is that people who put unknown code in their systems sometimes gets screwed?
Well, we better fix that then.
Poor Post Title, Not-So-Severe Issue (Score:2)
The OFA [rapid7.com] outlines this issue. What they are saying is that because the Swagger is a JSON document, if you use a code generator that simply regurgitates its values without validation, you could end up with code executing in the context of whatever is consuming the API. The issue is with code generators, and not the swagger documentation .
An example they give as an attack on HTML is the following (with angle brackets instead of square ones, obviously):
"info": { "description": "[script]alert(1)[/script