swagger-api / swagger-api/swagger-ui

XSS issue reported in Swagger UI

Open
#7,986 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
29k
Forks
9.3k
Avg merge
2d 23h
Merged PRs (30d)
25

Description

I am using Swagger 4.6.1 version. Burp Suite identified a low severity XSS vulnerability. I am not able to find this in reported issues before.

https://portswigger.net/web-security/dom-based/open-redirection

Error description:
Data is read from location.pathname and passed to fetch.url.
The following value was injected into the source:
/////yefnoahky1%27%22%60'%22/yefnoahky1/%3E%3Cyefnoahky1//%3Exk5au2pz3h&

The previous value reached the sink as:
/////yefnoahky1'"`'"/yefnoahky1/><yefnoahky1//>xk5au2pz3h&/v2/api-docs

The stack trace at the source was:
at Object._0x33d7c2 [as proxiedGetterCallback] (:1:588475) at Object.get pathname [as pathname] (:1:298838) at window.onload

The stack trace at the sink was:
at Object.Lixzr (:1:175099) at Object.jNwri (:1:573993) at _0x5d9df9 (:1:590480) at Object.slXfY (:1:171588) at Object.AUuzK (:1:490930) at :1:498441 at swagger-ui-bundle.js:2:178775 at c (swagger-ui-bundle.js:2:778490) at Generator._invoke (swagger-ui-bundle.js:2:778278) at Generator.next (swagger-ui-bundle.js:2:778919) at o (/swagger-ui-bundle.js:2:3174) at s (swagger-ui-bundle.js:2:3373)

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the reported path-to-request flow in Swagger UI, focusing on window.onload, location.pathname, fetch.url, and the generated swagger-ui-bundle.js stack trace. Determine whether the injected pathname value produces an exploitable XSS or open redirect, then document a verified fix and regression coverage for the reported input.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.