Summary
Refitter may resolve attacker-controlled or attacker-influenced OpenAPI $ref values using unsafe defaults during C# client generation. Remote references can cause requests from a developer or CI host, while local and traversal-based references may disclose files accessible to that host.
Refitter may resolve attacker-controlled or attacker-influenced OpenAPI $ref values using unsafe defaults during C# client generation. Remote references can cause requests from a developer or CI host, while local and traversal-based references may disclose files accessible to that host.
Affected context
The issue can occur when the Refitter dotnet tool generates Refit interfaces or contracts from OpenAPI descriptions that contain untrusted or externally influenced references. Risk increases when the generation process runs on a developer workstation or CI host with network access and readable local files, and when $ref resolution permits remote URLs, absolute paths, or paths outside the intended input directory.
The issue can occur when the Refitter dotnet tool generates Refit interfaces or contracts from OpenAPI descriptions that contain untrusted or externally influenced references. Risk increases when the generation process runs on a developer workstation or CI host with network access and readable local files, and when $ref resolution permits remote URLs, absolute paths, or paths outside the intended input directory.
Exploit preconditions
- Attack surface: OpenAPI description processing during client and contract generation
- Required access: Ability to provide or influence the OpenAPI document or referenced schema content
- Trigger point:
$refresolution performed by the schema-generation pipeline - Why exploitation is possible: Unsafe reference handling may fetch remote resources or read local paths before the resulting content is incorporated into generated output
- Environmental dependency: The developer or CI host must be able to reach the referenced network destination or read the targeted local file
- Attack surface: OpenAPI description processing during client and contract generation
- Required access: Ability to provide or influence the OpenAPI document or referenced schema content
- Trigger point:
$refresolution performed by the schema-generation pipeline - Why exploitation is possible: Unsafe reference handling may fetch remote resources or read local paths before the resulting content is incorporated into generated output
- Environmental dependency: The developer or CI host must be able to reach the referenced network destination or read the targeted local file
Why this happens
The underlying issue is insufficient restriction of external resource resolution in a schema-processing workflow. References supplied through an OpenAPI document are treated as resolvable locations without adequately limiting network access, filesystem scope, or path traversal. This maps primarily to CWE-829: Inclusion of Functionality from Untrusted Control Sphere, with CWE-918: Server-Side Request Forgery applying when remote references cause server-side requests.
The underlying issue is insufficient restriction of external resource resolution in a schema-processing workflow. References supplied through an OpenAPI document are treated as resolvable locations without adequately limiting network access, filesystem scope, or path traversal. This maps primarily to CWE-829: Inclusion of Functionality from Untrusted Control Sphere, with CWE-918: Server-Side Request Forgery applying when remote references cause server-side requests.
Potential impact
- A developer or CI host may send requests to attacker-selected network locations
- Internal services or metadata endpoints could be probed from the generation environment
- Local files readable by the generation process may be disclosed
- Untrusted remote schema content could be incorporated into generated interfaces or contracts
- Sensitive information may be exposed through generated artifacts, logs, or build outputs
- CI confidentiality and supply-chain integrity could be weakened
- A developer or CI host may send requests to attacker-selected network locations
- Internal services or metadata endpoints could be probed from the generation environment
- Local files readable by the generation process may be disclosed
- Untrusted remote schema content could be incorporated into generated interfaces or contracts
- Sensitive information may be exposed through generated artifacts, logs, or build outputs
- CI confidentiality and supply-chain integrity could be weakened
General mitigation guidance
Mitigation generally focuses on treating all OpenAPI references as untrusted and restricting resolution by default.
Common defensive patterns include:
- Disable remote reference resolution unless it is explicitly required
- Permit only approved schemes, hosts, and repositories through an allowlist
- Constrain local resolution to a dedicated input directory and reject absolute paths or traversal outside that directory
- Validate and normalize references before attempting resolution
- Use isolated, least-privileged build environments with restricted network egress and filesystem access
- Separate generated artifacts from sensitive workspace files and credentials
- Prefer pinned, integrity-checked schema sources and review generated changes
Mitigation generally focuses on treating all OpenAPI references as untrusted and restricting resolution by default.
Common defensive patterns include:
- Disable remote reference resolution unless it is explicitly required
- Permit only approved schemes, hosts, and repositories through an allowlist
- Constrain local resolution to a dedicated input directory and reject absolute paths or traversal outside that directory
- Validate and normalize references before attempting resolution
- Use isolated, least-privileged build environments with restricted network egress and filesystem access
- Separate generated artifacts from sensitive workspace files and credentials
- Prefer pinned, integrity-checked schema sources and review generated changes
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis and code review checks for unrestricted
$refresolution - Tests containing remote URLs, absolute paths, and traversal-style references
- Build-policy rules that prohibit unexpected outbound requests during code generation
- Network monitoring for CI or developer tools contacting unapproved destinations
- File-access monitoring for schema generators reading outside designated input directories
- Review of generated artifacts for unexpected external content or sensitive data
Automated security review tools may help flag unrestricted URL handling, filesystem access, and missing allowlists.
Organizations can identify this class of issue through:
- Static analysis and code review checks for unrestricted
$refresolution - Tests containing remote URLs, absolute paths, and traversal-style references
- Build-policy rules that prohibit unexpected outbound requests during code generation
- Network monitoring for CI or developer tools contacting unapproved destinations
- File-access monitoring for schema generators reading outside designated input directories
- Review of generated artifacts for unexpected external content or sensitive data
Automated security review tools may help flag unrestricted URL handling, filesystem access, and missing allowlists.
