CyberRota Analysis
AI-GeneratedKiota versions prior to 1.32.5 are vulnerable to server-side request forgery (SSRF), remote file inclusion, and local file inclusion due to improper handling of OpenAPI $ref values, which can be exploited through attacker-controlled descriptions. This vulnerability can lead to unauthorized access to sensitive data or services during the build process. Organizations using Kiota for API client generation should prioritize upgrading to version 1.32.5 or later to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local absolute or out-of-tree file paths, allowing `kiota generate` on an attacker-controlled or attacker-influenced description to perform build-time SSRF, remote file inclusion, and local file inclusion by inlining external schemas such as REMOTE_KIOTA_PROP or Leaked into generated clients. This issue is fixed in version 1.32.5 by AllowedExternalOriginsStreamLoader and the --allowed-external-origins option.