Executive brief
YApi is an open-source API documentation and management platform. A stored XSS vulnerability in the interface remarks field allows users to inject malicious JavaScript code that executes when other team members view interface documentation. An attacker can use this to steal session tokens, credentials, or perform unauthorized actions on behalf of victims viewing the affected interface.
Technical details
This is a stored cross-site scripting (CWE-79) vulnerability in the yapi-vendor npm package affecting version 1.9.1 and earlier. The vulnerability exists in the interface edit page's remarks field, which fails to properly sanitize user input before storing and rendering HTML content. Attackers with access to create or edit interfaces can inject malicious SVG or HTML payloads (e.g., <svg onload=alert()> or <video onerror=alert()>) that are stored in the database. When any project member views the interface edit page, the payload is executed in their browser within the context of the application domain. This requires authentication to access the interface editor but affects all users subsequently viewing the compromised interface. No patch information is currently available in the advisory.
Affected products
- YMFE yapi-vendor up to 1.9.1
Timeline
- 2021-05-08: disclosed: Issue #2190 opened reporting stored XSS in remarks
- 2021-07-09: disclosed: Issue #2240 opened confirming stored XSS via SVG payload in remarks
- 2023-01-26: advisory: CVE-2021-36686 published and GHSA-4jqw-vfmj-9rmh advisory released