lucasrenaa/cve-2018-25031Python-based proof-of-concept script demonstrating CVE-2018-25031 XSS vulnerability in Swagger UI using Selenium for automated detection across multiple endpoints.
This repository contains a Python script that demonstrates a proof of concept (POC) of a Cross-Site Scripting (XSS) vulnerability in Swagger UI, using the Selenium library. The goal of this POC is to identify websites that are susceptible to this vulnerability by exploiting Swagger UI with a malicious payload.
Swagger UI is a widely used tool for viewing and interacting with APIs through a user-friendly interface. However, in version 2.9.2, a Cross-Site Scripting (XSS) vulnerability was identified that could allow an attacker to inject malicious JavaScript code into loaded Swagger UI pages.
XSS occurs when an application does not properly validate user-supplied data before displaying it on the page. In this case, an attacker can exploit the vulnerability by inserting malicious JavaScript code into Swagger UI input fields, which will be executed in the context of other users' browsers that access the same compromised page.
Note: The image above illustrates an example of how an attacker can insert an XSS payload into Swagger UI, taking advantage of a security flaw in affected versions.
The most effective way to mitigate this vulnerability is to ensure that Swagger UI is updated to a version that is not affected. Check the latest versions of Swagger UI and keep it always up to date.
For developers who want to use or customize Swagger UI, it is essential to properly validate input data before displaying it in the interface. Avoiding the direct rendering of HTML or JavaScript inserted by users is a recommended practice to prevent XSS vulnerabilities.
Here is a simplified example of how the vulnerability can be exploited using Swagger UI:
This section is intended for educational and informational purposes only. Do not encourage or engage in malicious or illegal activities. Always follow responsible disclosure practices when reporting vulnerabilities.
Make sure you have the following prerequisites installed before running the script:
pip install selenium
Clone or download this repository to your machine.
Edit the sites_para_testar.txt file and enter the URLs of the websites you want to test, one per line.
Open a terminal in the repository folder and run the script using the following command:
python main.py
The script will go through the websites listed in the sites_para_testar.txt file, access their Swagger UI URLs, and check whether an XSS alert is detected. The results will be recorded in three files: valido.txt for potentially vulnerable URLs, talvezvalido.txt for URLs that may be vulnerable, and naovalido.txt for non-vulnerable URLs.
The script uses the Selenium library to automate interaction with the Chrome browser. It loads the Swagger UI URLs configured in the sites_para_testar.txt file, adds a malicious payload to the configUrl parameter, and checks whether an XSS alert is triggered.
The script performs the following steps:
Imports the necessary libraries from Selenium and other dependencies.
Configures ChromeDriver options to ignore SSL and certificate errors.
Initializes the Chrome driver.
Reads the websites to be tested from the sites_para_testar.txt file and iterates over them.
Opens each Swagger UI URL with the malicious payload added.
Attempts to check whether an XSS alert is triggered.
Based on the check result, records the URLs in the valido.txt, talvezvalido.txt, or naovalido.txt files.
Closes the Chrome driver.
This script is provided for educational and cybersecurity awareness purposes only. It should not be used for malicious or illegal purposes. The author is not responsible for any misuse of this script or for any damages resulting from its use.
If you find any way to improve this script or have suggestions, feel free to create a pull request.
This project is licensed under the MIT License.