Executive brief
swagger-ui-dist is a JavaScript library that generates interactive API documentation from OpenAPI specifications. An attacker could trick users into clicking malicious links or buttons by hijacking click actions through a spoofing attack, potentially leading to account compromise or phishing attacks.
Technical details
This vulnerability is a clickjacking attack (CWE-1021) that allows remote attackers to hijack user click actions on swagger-ui-dist pages. The vulnerability affects all versions before 4.1.3 and does not require authentication. An attacker must persuade a victim to visit a malicious website hosting or embedding swagger-ui-dist, where the attacker can intercept and redirect click actions to perform unintended operations. The vulnerability was patched in version 4.1.3.
Affected products
- Swagger API swagger-ui-dist before 4.1.3
Timeline
- 2022-03-12: disclosed
- 2022-03-12: patched: Version 4.1.3 released