Description
swagger-ui使用了一个过时的库DomPurify，结合库的特性允许获得由查询参数控制的DOM型XSS,该漏洞允许攻击者在页面上注入任何属性的HTML元素 此漏洞 3.38.0 已经修复，建议受影响用户及时升级更新 Swagger UI 到最新版本。漏洞利用点为index.html?configUrl=xxx.json或index.html?url=xxx.yaml FoFa：icon_hash="-1180440057"
Swagger-UI-XSS: 3.14.1<=Swagger-UI-XSS< 3.38.0
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/VictorNS69/swagger-ui-xss
https://www.tenable.com/plugins/was/113267
https://blog.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers
https://www.acunetix.com/vulnerabilities/web/swagger-ui-dom-xss-vulnerability/
https://the-red.team/post/templates/swagger-xss/
https://docs.ed-fi.org/reference/roadmap/advisories/swagger-xss
https://security.snyk.io/package/npm/swagger-ui/3.14.1