GMS-2020-785: Cross-Site Scripting in swagger-ui

September 1, 2020 (updated September 23, 2021)

Affected versions of swagger-ui are vulnerable to cross-site scripting. This vulnerability exists because swagger-ui automatically executes external Javascript that is loaded in via the url query string parameter when a Content-Type: application/javascript header is included.

An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a swagger-ui URL that includes the location to their server/script in the url query string parameter. When viewed, such a link would execute the attacker’s malicious script.

Recommendation

Update to 2.2.1 or later.

References

github.com/advisories/GHSA-mrx7-8hxf-f853
github.com/swagger-api/swagger-ui/issues/1863
nvd.nist.gov/vuln/detail/CVE-2016-1000233
www.npmjs.com/advisories/131

Detect and mitigate GMS-2020-785 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →