exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Swagger Editor 2.9.9 Cross Site Scripting

Swagger Editor 2.9.9 Cross Site Scripting
Posted May 3, 2016
Authored by Julien Ahrens | Site rcesecurity.com

Swagger Editor version 2.9.9 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 2c9f139677da0df23f3a83e1dfd810fd387124a00de5fae2c2e07e62c09ac0ef

Swagger Editor 2.9.9 Cross Site Scripting

Change Mirror Download
Swagger Editor v2.9.9 "description" Key DOM-based Cross-Site Scripting

RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product: Swagger Editor
Vendor URL: https://github.com/swagger-api/swagger-editor
Type: Cross-Site Scripting [CWE-79]
Date found: 2015-04-07
Date published: 2016-05-03
CVSSv3 Score: 6.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE: -


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
Swagger Editor v2.9.9 (latest)
older versions may be affected too.


4. INTRODUCTION
===============
Swagger Editor lets you edit Swagger API specifications in YAML inside your
browser and to preview documentations in real time. Valid Swagger JSON
descriptions can then be generated and used with the full Swagger tooling
(code generation, documentation, etc).

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The application "Swagger Editor" offers the functionality to import Swagger
API specifications via a remote YAML/JSON file, but does not properly
validate the "description" key within the imported specification file, which
could lead to an unauthenticated DOM-based Cross-Site Scripting
vulnerability.

The following Proof-of-Concept YAML file triggers this vulnerability:

swagger: '2.0'
info:
version: 1.0.0
title: Echo
description: '<script>alert(document.domain)</script>'
paths:
/:
get:
responses:
'200':
description: Echo GET


6. RISK
=======
To successfully exploit this vulnerability, the user must be tricked into
importing an arbitrary JSON or YAML file either via the file system or
via a
remote URL.

The vulnerability can be used to temporarily embed arbitrary script code
into the context of the Swagger Editor interface, which offers a wide range
of possible attacks such as client-side context manipulation or attacking
the browser and its components.


7. SOLUTION
===========
None.


8. REPORT TIMELINE
==================
2015-04-07: Discovery of the vulnerability
2015-04-07: Notified vendor via contact addresses on GitHub
2015-04-14: Notified vendor via contact addresses on GitHub
2015-04-23: Notified vendor via contact addresses on GitHub
2015-05-02: Notified vendor via contact addresses on GitHub
2015-05-02: Vendor states that creating a public GitHub issue is the
proper way
according to their policy
2016-05-03: Created https://github.com/swagger-api/swagger-editor/issues/908
2016-05-03: Advisory released


9. REFERENCES
-------------
https://github.com/swagger-api/swagger-editor/issues/908

Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close