Summary
An attacker-controlled Protobuf schema can cause datamodel-code-generator to write generated content outside its intended temporary directory. If a victim or automated job processes that schema with Protobuf support enabled, the issue may create directories or overwrite existing writable files, although direct arbitrary code execution has not been demonstrated.
An attacker-controlled Protobuf schema can cause datamodel-code-generator to write generated content outside its intended temporary directory. If a victim or automated job processes that schema with Protobuf support enabled, the issue may create directories or overwrite existing writable files, although direct arbitrary code execution has not been demonstrated.
Affected context
The vulnerability occurs during Protobuf schema processing when weak import paths are extracted and used to create files before the Protobuf compiler runs. It requires Protobuf input support and the grpcio-tools package, and is relevant where an attacker can supply a schema to a victim-controlled or automated code-generation workflow.
The vulnerability occurs during Protobuf schema processing when weak import paths are extracted and used to create files before the Protobuf compiler runs. It requires Protobuf input support and the grpcio-tools package, and is relevant where an attacker can supply a schema to a victim-controlled or automated code-generation workflow.
Exploit preconditions
- Attack surface: Protobuf schema parsing and weak-import file generation - Required access: Ability to provide or influence a schema processed by the
affected code-generation workflow
- Required component: Protobuf input support with grpcio-tools available - Trigger point: Handling of weak import paths before protoc compilation - Why exploitation is possible: Absolute or parent-directory paths can escape
the intended temporary directory and target writable filesystem locations
- Attack surface: Protobuf schema parsing and weak-import file generation - Required access: Ability to provide or influence a schema processed by the
affected code-generation workflow
- Required component: Protobuf input support with grpcio-tools available - Trigger point: Handling of weak import paths before protoc compilation - Why exploitation is possible: Absolute or parent-directory paths can escape
the intended temporary directory and target writable filesystem locations
Why this happens
The underlying bug is insufficient restriction and normalization of attacker-controlled filesystem paths. Values matched from a Protobuf schema are used by the weak-import handling logic without reliably constraining them to the designated temporary directory, allowing path traversal through absolute or parent-directory references. This maps primarily to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, and is also related to CWE-73, External Control of File Name or Path.
The underlying bug is insufficient restriction and normalization of attacker-controlled filesystem paths. Values matched from a Protobuf schema are used by the weak-import handling logic without reliably constraining them to the designated temporary directory, allowing path traversal through absolute or parent-directory references. This maps primarily to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, and is also related to CWE-73, External Control of File Name or Path.
Potential impact
- An attacker may create directory trees in writable locations.
- An attacker may overwrite existing writable files with a Protobuf syntax declaration.
- Generated or automation environments could experience configuration or source-file corruption.
- The written changes may persist even when subsequent Protobuf compilation fails.
- Downstream build, testing, or deployment workflows could be disrupted.
- An attacker may create directory trees in writable locations.
- An attacker may overwrite existing writable files with a Protobuf syntax declaration.
- Generated or automation environments could experience configuration or source-file corruption.
- The written changes may persist even when subsequent Protobuf compilation fails.
- Downstream build, testing, or deployment workflows could be disrupted.
General mitigation guidance
Mitigation generally focuses on treating schema-derived paths as untrusted and enforcing a strict filesystem boundary. Secure-by-default designs can restrict writes to an isolated temporary directory, reject absolute paths and parent-directory traversal, canonicalize paths before authorization checks, and use allowlisted filenames or schemas. File creation can be constrained with exclusive or atomic write behavior, while writable directories and process privileges should be minimized. Separating parsing from file generation and validating all paths before any write reduces exposure to partial changes.
Mitigation generally focuses on treating schema-derived paths as untrusted and enforcing a strict filesystem boundary. Secure-by-default designs can restrict writes to an isolated temporary directory, reject absolute paths and parent-directory traversal, canonicalize paths before authorization checks, and use allowlisted filenames or schemas. File creation can be constrained with exclusive or atomic write behavior, while writable directories and process privileges should be minimized. Separating parsing from file generation and validating all paths before any write reduces exposure to partial changes.
How teams detect issues like this
Detection can include static analysis for filesystem writes that consume schema-derived or other external path values, along with checks for path joining without canonicalization and boundary validation. Code review should examine temporary-directory handling, absolute-path acceptance, parent traversal, and writes performed before full input validation. Runtime monitoring can alert on unexpected file creation or modification outside approved workspaces, and CI policy can require isolated output directories for schema-processing jobs. Automated security review tools may help identify these patterns.
Detection can include static analysis for filesystem writes that consume schema-derived or other external path values, along with checks for path joining without canonicalization and boundary validation. Code review should examine temporary-directory handling, absolute-path acceptance, parent traversal, and writes performed before full input validation. Runtime monitoring can alert on unexpected file creation or modification outside approved workspaces, and CI policy can require isolated output directories for schema-processing jobs. Automated security review tools may help identify these patterns.
