Quick answers
- Is CVE-2016-1000226 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2016-1000226 being exploited in the wild.
- How severe is CVE-2016-1000226?
- Informational severity, published 1 September 2020.
- Which products and versions are affected?
- swagger-ui (npm) SEMVER:introduced=0,fixed=2.2.1.
- Is there a fix for CVE-2016-1000226?
- Yes. swagger-ui (npm): upgrade to 2.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2016-1000226 attacked?
- It is attacked over the network.
- Am I affected by CVE-2016-1000226?
- Check whether you run swagger-ui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- swagger-ui (npm): upgrade to 2.2.1 or later
npm install swagger-ui@2.2.1
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in swagger-ui versions prior to 2.2.1. The root cause is that user-supplied data in the "consumes" and "produces" fields of Swagger JSON documents are rendered without proper HTML entity encoding. An attacker can supply a malicious Swagger JSON file via the "url" query parameter, causing swagger-ui to load and parse it. When the JSON is displayed in the UI, any JavaScript payloads embedded in these fields will execute with the privileges of the authenticated user. No special authentication is required; an attacker only needs to convince a user to click a crafted link. The fix available in version 2.2.1 and later properly escapes these fields to prevent script injection.
Affected products
- Swagger swagger-ui prior to 2.2.1
Identifiers
- CVE-2016-1000226
- GHSA-7f59-x49p-v8mq
Timeline
- 2016-01-13: disclosed: Issue opened on GitHub
- 2016: patched: Fixed in version 2.2.1
- 2020-09-01: advisory: Published in GHSA