CyberRota Analysis
AI-GeneratedThe oasdiff-action GitHub Action, prior to version 0.0.51, is vulnerable to Server-Side Request Forgery (SSRF) due to its default behavior of resolving external references in OpenAPI specifications. This flaw allows an attacker to exploit pull requests from public repositories to access sensitive files on the runner without user interaction. Organizations using this action, particularly those managing public repositories, should prioritize updating to the patched version to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.