Executive brief
swagger-injector is a Node.js library used to inject Swagger/OpenAPI documentation into web applications. Due to improper URL sanitization, an attacker can use path traversal sequences (e.g., "../") to access arbitrary files on the server outside the intended distribution folder, potentially exposing sensitive configuration files, source code, or other confidential data.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in swagger-injector affecting all versions. The package fails to properly sanitize or validate user-supplied URLs before serving files, allowing attackers to traverse the filesystem using relative path notation. An attacker can craft requests with sequences like "../" to access files outside the configured dist folder. The attack requires network access to an application using the vulnerable library, with no authentication typically required. Successful exploitation enables arbitrary file read on the server. No patch has been released; users are advised to discontinue use of this package.
Affected products
- npm swagger-injector all versions
Timeline
- 2020-09-03: disclosed
- 2020-08-31: advisory