Executive brief
Swagger UI is a popular web-based API documentation tool. The vulnerability allows attackers to inject and execute malicious JavaScript in users' browsers by crafting a malicious link with a specially crafted URL parameter that references an attacker-controlled server. When a user clicks the link, the attacker's script executes with the same privileges as the user, potentially compromising API credentials, session tokens, or sensitive data visible in the documentation.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in Swagger UI versions prior to 2.2.1. The root cause is that Swagger UI automatically executes external JavaScript loaded via the "url" query string parameter when the response includes a Content-Type: application/javascript header, without proper sanitization. An attacker can set up a malicious server returning JavaScript with the correct content-type header, then craft a Swagger UI URL embedding that server's address in the url parameter. When a victim visits the malicious link, the attacker's script executes in their browser context. The attack requires social engineering (convincing a user to click a link) but no authentication. A fix was released in version 2.2.1.
Affected products
- Swagger API Swagger UI before 2.2.1
Timeline
- 2016-01-12: disclosed
- 2016: patched: Fixed in version 2.2.1