Executive brief
Swagger-UI is an open-source framework for documenting and testing REST APIs. A CSS injection vulnerability allows attackers to manipulate styling rules to steal sensitive data like CSRF tokens from form fields displayed in the UI, potentially compromising API security and user sessions.
Technical details
A CSS injection vulnerability in Swagger-UI before version 3.23.11 allows attackers to exploit the Relative Path Overwrite (RPO) technique to inject malicious CSS rules. The vulnerability exists because Swagger-UI intentionally embeds untrusted JSON data from remote servers without properly sanitizing CSS content. An attacker can inject CSS that uses attribute selectors to exfiltrate input field values (such as CSRF tokens) to an attacker-controlled server. This attack requires network access to the Swagger-UI interface and user interaction with the page. The vulnerability is fixed in version 3.23.11 and later releases.
Affected products
- Swagger Swagger-UI before 3.23.11
- SpringFox springfox-swagger-ui before 2.10.0
Timeline
- 2019-10-15: disclosed: Advisory published (GHSA-c427-hjc3-wrfw)
- 2019-10-15: patched: Fixed in Swagger-UI 3.23.11; SpringFox 2.10.0