Executive brief
Swagger UI is a web-based tool used to display and test API documentation. The vulnerability allows attackers to inject malicious JavaScript code through the "consumes" and "produces" fields in API specification documents. An attacker can craft a link pointing to a malicious API specification file, and if a user visits that link, the injected code will execute in their browser, potentially compromising their session or stealing sensitive data.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in swagger-ui versions prior to 2.2.1. The root cause is that user-supplied data in the "consumes" and "produces" fields of Swagger JSON documents are rendered without proper HTML entity encoding. An attacker can supply a malicious Swagger JSON file via the "url" query parameter, causing swagger-ui to load and parse it. When the JSON is displayed in the UI, any JavaScript payloads embedded in these fields will execute with the privileges of the authenticated user. No special authentication is required; an attacker only needs to convince a user to click a crafted link. The fix available in version 2.2.1 and later properly escapes these fields to prevent script injection.
Affected products
- Swagger swagger-ui prior to 2.2.1
Timeline
- 2016-01-13: disclosed: Issue opened on GitHub
- 2016: patched: Fixed in version 2.2.1
- 2020-09-01: advisory: Published in GHSA