Executive brief
Swagger UI is a widely-used API documentation tool. In versions before 3.18.0, the tool improperly used HTML anchor tags with target="_blank", which can allow attackers to manipulate the original page when users click on external links. This weakness is commonly exploited for phishing attacks where victims are redirected to malicious pages that appear to be the original site.
Technical details
The vulnerability is a reverse tabnapping flaw (CWE-1022) in Swagger UI's anchor tag implementation. When anchor tags open links in new tabs/windows using target="_blank" without rel="noopener noreferrer" attributes, the newly opened page gains access to the window.opener property of the original page, allowing attackers to redirect users back to a phishing site. The flaw requires user interaction (clicking a link) but has a network attack vector since the malicious link can be hosted externally. The fix, released in version 3.18.0, replaces unsafe anchor tags with proper Link components that include the necessary security attributes.
Affected products
- Swagger API Swagger UI prior to 3.18.0
Timeline
- 2019-06-20: disclosed
- 2019-06-20: patched: Fix released in version 3.18.0