BugTraq
Swagger Editor v2.9.9 "description" Key DOM-based Cross-Site Scripting May 03 2016 06:36PM
Julien Ahrens (info rcesecurity com)
Swagger Editor v2.9.9 "description" Key DOM-based Cross-Site Scripting

RCE Security Advisory
https://www.rcesecurity.com

1. ADVISORY INFORMATION
=======================
Product: Swagger Editor
Vendor URL: https://github.com/swagger-api/swagger-editor
Type: Cross-Site Scripting [CWE-79]
Date found: 2015-04-07
Date published: 2016-05-03
CVSSv3 Score: 6.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
CVE: -

2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.

3. VERSIONS AFFECTED
====================
Swagger Editor v2.9.9 (latest)
older versions may be affected too.

4. INTRODUCTION
===============
Swagger Editor lets you edit Swagger API specifications in YAML inside your
browser and to preview documentations in real time. Valid Swagger JSON
descriptions can then be generated and used with the full Swagger tooling
(code generation, documentation, etc).

(from the vendor's homepage)

5. VULNERABILITY DETAILS
========================
The application "Swagger Editor" offers the functionality to import Swagger
API specifications via a remote YAML/JSON file, but does not properly
validate the "description" key within the imported specification file, which
could lead to an unauthenticated DOM-based Cross-Site Scripting
vulnerability.

The following Proof-of-Concept YAML file triggers this vulnerability:

swagger: '2.0'
info:
version: 1.0.0
title: Echo
description: '<script>alert(document.domain)</script>'
paths:
/:
get:
responses:
'200':
description: Echo GET

6. RISK
=======
To successfully exploit this vulnerability, the user must be tricked into
importing an arbitrary JSON or YAML file either via the file system or
via a
remote URL.

The vulnerability can be used to temporarily embed arbitrary script code
into the context of the Swagger Editor interface, which offers a wide range
of possible attacks such as client-side context manipulation or attacking
the browser and its components.

7. SOLUTION
===========
None.

8. REPORT TIMELINE
==================
2015-04-07: Discovery of the vulnerability
2015-04-07: Notified vendor via contact addresses on GitHub
2015-04-14: Notified vendor via contact addresses on GitHub
2015-04-23: Notified vendor via contact addresses on GitHub
2015-05-02: Notified vendor via contact addresses on GitHub
2015-05-02: Vendor states that creating a public GitHub issue is the
proper way
according to their policy
2016-05-03: Created https://github.com/swagger-api/swagger-editor/issues/908
2016-05-03: Advisory released

9. REFERENCES
-------------
https://github.com/swagger-api/swagger-editor/issues/908

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXKO/DAAoJELLTnL9hzYr6W54P/AlKGAEPt1a5wy7Dgk4yJZRw
MvUmvF9JhtyrFFNX5Gtm3WPMg3jsI+HouwUibpn7zmhPrg0epWYufAAm1qVI8n95
ADbA7jN6QBfTGru+Wcp+NB10YiYC5RoGqvMr/JdxYS1+5aMcfAiSnt6xwh6tU4Qz
e1Extowd7EL0t8mAsYRHzQKxrm5ny0l0NGxx3ml8ss4tjQiyphkRKS6wwcavtDxo
+IWtXaF1qHt2p32t5pqiB05Ch8Mu55qPA3MX05ADrC7zS2B+OJ60s4aU0Z9oHM/D
G3YxKmCNOSt9Iyjita0Ar8HnT0ya7iMiyWzxlWFYBI4kruCfgfkibw9bMy5w3O//
4Siq+lXowhnC/PH6jTWLmJTIopeVosp0Li+Tt2WZF64De3gBdZKAzXxzRIx2fbZc
1T1G6SMqYCeXW+eho5fZ1BCX46UNESuubwk02+IkV7qu+MizHH10IfRSlpXShjKD
BoJNZ27d6QkT0T2gCOfMTEbXU55WmgthwovgGDoycnssxic14rvCyJCtiYA3xMrI
TRYflsRw/PE5Rckka0EW4iXkJxA6RR/ov0N2DMQh6RfFhTpBUhgVwssKSIRiLsit
8yS5UqKlv0RNIlrLE6SzXTd1/MIrrRwpWk+Mb7nvHFuKDRkABmHwhddybychUf1G
k2Q16iCA8q/MZxz+DYpH
=4YlY
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus