Intrusion Prevention

JSON.Swagger.CodeGen.Parameter.Remote.Code.Execution

Description

This indicates an attack attempt to exploit a remote Code Execution vulnerability in Software using Swagger JSON File.
The vulnerability is due to insufficient input validation when handling a Swagger JSON File. A remote attacker may be able to exploit this to execute arbitrary code on vulnerable systems via a crafted Swagger JSON File.

Affected Products

Open API Specification 2.0 (Swagger) compliant JSON document for Ruby
Open API Specification 2.0 (Swagger) compliant JSON document for PHP
Open API Specification 2.0 (Swagger) compliant JSON document for Java
Open API Specification 2.0 (Swagger) compliant JSON document for NodeJS
Open API Specification 2.0 (Swagger) compliant JSON document for HTML

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

Currently we are unaware of any vendor supplied patch for this issue.

CVE References

CVE-2016-5641