Executive brief
Swagger UI, a tool used to visualize and interact with API documentation, is vulnerable to a security flaw that could allow attackers to run malicious scripts in a user's browser. This occurs when the tool displays a response from an API that is unexpectedly formatted as HTML instead of data. If an attacker can trick a user into interacting with a malicious API through the Swagger interface, they could potentially steal session information or perform actions on the user's behalf.
Technical details
Swagger UI versions prior to 2.2.1 are vulnerable to reflected Cross-Site Scripting (XSS). The vulnerability exists because the application fails to properly sanitize or encode output when an API endpoint returns a 'text/html' Content-Type, even if the UI expected 'application/json'. An attacker can exploit this by hosting or manipulating an API response to include malicious <script> tags, which are then executed in the context of the Swagger UI web page when a user clicks the 'Try it out!' button. This issue is resolved in version 2.2.1 by ensuring that HTML responses are properly encoded before being rendered.
Affected products
- Swagger API swagger-ui < 2.2.1
Timeline
- 2015-04-13: disclosed: Issue reported on GitHub
- 2020-09-11: advisory: GitHub Advisory published