CVE-2018-25031: Swagger UI spoofing attack via URL parameter

CVE-2018-25031 · Severity: low · CVSS 3.1 · Published 2022-03-12

Swagger UI is a widely-used interface for browsing and testing REST APIs. By crafting a specially-formatted URL, an attacker could trick users into loading malicious API definitions, potentially capturing login credentials or sensitive data through a fake authentication flow. The vulnerability allows the ?url= query parameter to override hard-coded API definitions, enabling phishing-style attacks against developers and API consumers.

Technologies: swagger-ui (npm). Vendors: Maven, npm.

Quick answers

Is CVE-2018-25031 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2018-25031 being exploited in the wild.
How severe is CVE-2018-25031?
Low severity, with a CVSS score of 3.1, published 12 March 2022.
Which products and versions are affected?
org.webjars:swagger-ui (Maven) ECOSYSTEM:introduced=0,fixed=4.1.3; swagger-ui (npm) SEMVER:introduced=0,fixed=4.1.3.
Is there a fix for CVE-2018-25031?
Yes. org.webjars:swagger-ui (Maven): upgrade to 4.1.3 or later; swagger-ui (npm): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-25031 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2018-25031?
Check whether you run org.webjars:swagger-ui (Maven) or swagger-ui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars:swagger-ui (Maven): upgrade to 4.1.3 or later
    # set org.webjars:swagger-ui to 4.1.3 in your pom.xml or build.gradle
  • swagger-ui (npm): upgrade to 4.1.3 or later
    npm install swagger-ui@4.1.3

Technical details

The vulnerability is an improper input validation issue (CWE-20, CWE-918, CWE-922) where Swagger UI versions before 4.1.3 fail to restrict the ?url= query parameter from overriding API definition sources. An attacker can craft a URL directing a victim to a legitimate Swagger UI instance with a ?url= parameter pointing to a malicious OpenAPI definition hosted on attacker-controlled infrastructure. When the victim clicks the link, the UI loads and displays the attacker's API definition instead of the legitimate one. This enables credential harvesting through fake login endpoints or social engineering attacks. The attack requires user interaction (clicking a malicious link) but no authentication. The fix, released in version 4.1.3, adds an enableQueryConfig option (defaulting to false in 4.x) to disable or restrict query parameter-based configuration overrides.

Affected products

  • Swagger swagger-ui before 4.1.3

Identifiers

  • CVE-2018-25031
  • GHSA-cr3q-pqgq-m8c2

Timeline

  • 2018-09-13: disclosed: Security report submitted to Swagger team; publicly disclosed in GitHub issue #4872
  • 2022-03-11: patched: Fix released in version 4.1.3
  • 2022-03-12: advisory: GHSA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.