swagger-api / swagger-api/swagger-ui
XSS issue reported in Swagger UI
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 29k
- Forks
- 9.3k
- Avg merge
- 2d 23h
- Merged PRs (30d)
- 25
Description
I am using Swagger 4.6.1 version. Burp Suite identified a low severity XSS vulnerability. I am not able to find this in reported issues before.
https://portswigger.net/web-security/dom-based/open-redirection
Error description:
Data is read from location.pathname and passed to fetch.url.
The following value was injected into the source:
/////yefnoahky1%27%22%60'%22/yefnoahky1/%3E%3Cyefnoahky1//%3Exk5au2pz3h&
The previous value reached the sink as:
/////yefnoahky1'"`'"/yefnoahky1/><yefnoahky1//>xk5au2pz3h&/v2/api-docs
The stack trace at the source was:
at Object._0x33d7c2 [as proxiedGetterCallback] (:1:588475) at Object.get pathname [as pathname] (:1:298838) at window.onload
The stack trace at the sink was:
at Object.Lixzr (:1:175099) at Object.jNwri (:1:573993) at _0x5d9df9 (:1:590480) at Object.slXfY (:1:171588) at Object.AUuzK (:1:490930) at :1:498441 at swagger-ui-bundle.js:2:178775 at c (swagger-ui-bundle.js:2:778490) at Generator._invoke (swagger-ui-bundle.js:2:778278) at Generator.next (swagger-ui-bundle.js:2:778919) at o (/swagger-ui-bundle.js:2:3174) at s (swagger-ui-bundle.js:2:3373)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported path-to-request flow in Swagger UI, focusing on window.onload, location.pathname, fetch.url, and the generated swagger-ui-bundle.js stack trace. Determine whether the injected pathname value produces an exploitable XSS or open redirect, then document a verified fix and regression coverage for the reported input.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100