Swagger UI phishing vector via URL parameter

Severity: info · CVSS 6.5 · Published 2021-12-09

Swagger UI is a library for displaying API documentation. The tool supports loading remote API definitions via a URL parameter, which can be abused in phishing attacks. An attacker can trick users into clicking a link to a legitimate organization's Swagger UI instance (e.g., example.com) but with a malicious URL parameter pointing to a fake API, causing users to unknowingly submit credentials or sensitive data to the attacker's server.

Technologies: swagger-ui (npm). Vendors: npm, NuGet.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Informational severity, with a CVSS score of 6.5, published 9 December 2021.
Which products and versions are affected?
swagger-ui (npm) SEMVER:introduced=0,fixed=4.1.3; swagger-ui-dist (npm) SEMVER:introduced=0,fixed=4.1.3; swagger-ui-react (npm) SEMVER:introduced=0,fixed=4.1.3; Swashbuckle.AspNetCore.SwaggerUI (NuGet) ECOSYSTEM:introduced=0,fixed=6.3.0.
Is there a fix for This vulnerability?
Yes. swagger-ui (npm): upgrade to 4.1.3 or later; swagger-ui-dist (npm): upgrade to 4.1.3 or later; swagger-ui-react (npm): upgrade to 4.1.3 or later; Swashbuckle.AspNetCore.SwaggerUI (NuGet): upgrade to 6.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run swagger-ui (npm), swagger-ui-dist (npm), swagger-ui-react (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • swagger-ui (npm): upgrade to 4.1.3 or later
    npm install swagger-ui@4.1.3
  • swagger-ui-dist (npm): upgrade to 4.1.3 or later
    npm install swagger-ui-dist@4.1.3
  • swagger-ui-react (npm): upgrade to 4.1.3 or later
    npm install swagger-ui-react@4.1.3
  • Swashbuckle.AspNetCore.SwaggerUI (NuGet): upgrade to 6.3.0 or later
    dotnet add package Swashbuckle.AspNetCore.SwaggerUI --version 6.3.0

Technical details

Swagger UI versions prior to 4.1.3 allow the ?url query parameter to load remote OpenAPI definitions without restriction. The vulnerability is a server-side request forgery (SSRF) and phishing attack vector where an attacker crafts a URL like https://example.com/api-docs?url=https://evildomain/fakeapi.yaml. When a user clicks this link and uses the "Try-it-out" feature to test APIs, requests are sent to the attacker's server. The attack requires user interaction (clicking the malicious link and submitting data) and cannot be exploited non-interactively for code injection or XSS. The fix, released in version 4.1.3, disables the ?url parameter by default; administrators can re-enable it if needed.

Affected products

  • Swagger Swagger UI < 4.1.3
  • Swagger Swagger UI Dist < 4.1.3
  • Swagger Swagger UI React < 4.1.3
  • Swashbuckle Swashbuckle.AspNetCore.SwaggerUI versions with vulnerable Swagger UI

Timeline

  • 2021-12-09: disclosed: Advisory published
  • 2021-12: patched: Version 4.1.3 released with query parameters disabled by default

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.