CVE-2018-17574: YMFE YApi stored cross-site scripting in project name

CVE-2018-17574 · Severity: low · CVSS 3 · Published 2018-11-21

YMFE YApi is a visual API management platform that allows teams to manage and document APIs. A stored cross-site scripting (XSS) vulnerability in the project name field allows authenticated users to inject malicious JavaScript that executes when other users (including administrators) view project details or activity logs. An attacker could steal session tokens, modify project data, or perform actions on behalf of other users.

Technologies: yapi-vendor (npm), Ymfe Yapi. Vendors: npm, Ymfe.

Quick answers

Is CVE-2018-17574 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-17574 being exploited in the wild.
How severe is CVE-2018-17574?
Low severity, with a CVSS score of 3, published 21 November 2018.
Which products and versions are affected?
yapi-vendor (npm) SEMVER:introduced=0,fixed=1.3.23; Ymfe Yapi <1.3.23.
Is there a fix for CVE-2018-17574?
Yes. yapi-vendor (npm): upgrade to 1.3.23 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-17574 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-17574?
Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • yapi-vendor (npm): upgrade to 1.3.23 or later
    npm install yapi-vendor@1.3.23

Technical details

The vulnerability is a stored (persistent) cross-site scripting flaw in the project name field of YMFE YApi versions prior to 1.3.23. The application fails to properly sanitize or encode user input when storing and displaying project names, allowing attackers to inject arbitrary HTML and JavaScript payloads. Exploitation requires an authenticated user account to create or modify a project; the malicious payload then executes in the browsers of other users (including managers and administrators) when they view the project or its operation dynamics. An attacker can achieve session hijacking, data theft, or privilege escalation by executing arbitrary actions on behalf of legitimate users. The vulnerability was patched in version 1.3.23.

Affected products

  • YMFE YApi <1.3.23

Identifiers

  • CVE-2018-17574
  • GHSA-5xgh-643p-cp2g

Timeline

  • 2018-08-31: disclosed: Issue reported on GitHub
  • 2018-11-21: advisory: GHSA advisory published
  • 2018-11-21: patched: Fix available in version 1.3.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.