Executive brief
Swagger UI is a widely-used interface for browsing and testing REST APIs. By crafting a specially-formatted URL, an attacker could trick users into loading malicious API definitions, potentially capturing login credentials or sensitive data through a fake authentication flow. The vulnerability allows the ?url= query parameter to override hard-coded API definitions, enabling phishing-style attacks against developers and API consumers.
Technical details
The vulnerability is an improper input validation issue (CWE-20, CWE-918, CWE-922) where Swagger UI versions before 4.1.3 fail to restrict the ?url= query parameter from overriding API definition sources. An attacker can craft a URL directing a victim to a legitimate Swagger UI instance with a ?url= parameter pointing to a malicious OpenAPI definition hosted on attacker-controlled infrastructure. When the victim clicks the link, the UI loads and displays the attacker's API definition instead of the legitimate one. This enables credential harvesting through fake login endpoints or social engineering attacks. The attack requires user interaction (clicking a malicious link) but no authentication. The fix, released in version 4.1.3, adds an enableQueryConfig option (defaulting to false in 4.x) to disable or restrict query parameter-based configuration overrides.
Affected products
- Swagger swagger-ui before 4.1.3
Timeline
- 2018-09-13: disclosed: Security report submitted to Swagger team; publicly disclosed in GitHub issue #4872
- 2022-03-11: patched: Fix released in version 4.1.3
- 2022-03-12: advisory: GHSA advisory published