Affected versions of swagger-ui contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.

Proof of Concept

The vulnerable object structure is:

{
    "definitions": {
        "arbitraryVal": {
            "properties": {
                "<INJECTABLE_KEY_NAME>": "LoremIpsum"
                }
            }
        }
}

Malicious JSON documents can be loaded in by providing a URL to them in the url query string parameter.

Recommendation

Update to version 2.2.1 or later.

References

• swagger-api/swagger-ui#1865
• https://www.npmjs.com/advisories/126
• https://nvd.nist.gov/vuln/detail/CVE-2016-5682
• https://community.rapid7.com/community/infosec/blog/2016/09/02/r7-2016-19-persistent-xss-via-unescaped-parameters-in-swagger-ui