Executive brief
Swagger UI is a popular open-source tool for generating interactive API documentation from API specifications. Versions before 2.2.1 fail to properly sanitize HTML content in the API description field, allowing attackers to inject malicious JavaScript code that executes in users' browsers when viewing the API documentation.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in the swagger-ui library affecting all versions prior to 2.2.1. The vulnerability exists in the swagger.apiInfo.description field, which accepts and renders HTML without proper sanitization. An attacker can inject arbitrary JavaScript by crafting a malicious API specification with script tags or event handlers in the description field. When a user views the generated documentation, the injected script executes in their browser context, potentially allowing session hijacking, credential theft, or malware distribution. The fix was released in version 2.2.1 and later, which implements proper HTML escaping or sanitization of the description field.
Affected products
- Swagger swagger-ui before 2.2.1
Timeline
- 2020-09-11: disclosed
- 2020-09-11: patched: Version 2.2.1 released