Executive brief
Swagger UI is a tool that automatically generates interactive API documentation from API specifications. Versions prior to 2.2.1 fail to properly sanitize method descriptions in API schemas, allowing an attacker to embed malicious scripts that execute in the browsers of users viewing the documentation. This could lead to theft of authentication tokens, session hijacking, or other attacks against users accessing API documentation.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in Swagger UI versions before 2.2.1. The root cause is insufficient input sanitization of JSON schema method descriptions; attackers can inject <script> tags and arbitrary JavaScript code into the description fields. The vulnerability is triggered when a victim visits a Swagger UI page that loads a malicious API schema—no authentication or user interaction beyond viewing the page is required. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially stealing credentials, session tokens, or performing actions on behalf of the user. The fix is to upgrade to version 2.2.1 or later.
Affected products
- Swagger API swagger-ui prior to 2.2.1
Timeline
- 2016-01-12: disclosed
- 2020-09-11: patched: Advisory published; version 2.2.1 available as fix
- 2020-09-11: advisory