Executive brief
swagger-ui is a popular UI library for displaying API documentation. A cross-site scripting (XSS) vulnerability in versions before 2.2.1 allows attackers to inject malicious scripts through JSON schema property names. An attacker can craft a malicious JSON document and trick users into loading it via a URL parameter, causing arbitrary JavaScript to execute in their browser and potentially stealing session tokens or sensitive data.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in swagger-ui's rendering of JSON schema definitions. The vulnerable code fails to properly escape property names when displaying them in the UI, allowing JavaScript code embedded in property keys (e.g., "<script>alert(1)</script>") to execute in the browser. The attack is client-side: an attacker provides a URL to a malicious JSON schema file via the url query string parameter, which swagger-ui loads and renders without sanitizing the property names. No authentication is required—any user can be tricked into accessing a swagger-ui instance with a malicious URL. The impact is full XSS in the user's browser context. The vulnerability was fixed in version 2.2.1 and later.
Affected products
- SmartBear Software swagger-ui before 2.2.1
Timeline
- 2016-01-13: disclosed: Issue reported on GitHub
- 2016: patched: Fixed in version 2.2.1
- 2020-09-01: advisory: Advisory GHSA-p239-93f7-h6xf published