CVE-2019-17495

What is the vulnerability?

A Cascading Style Sheets (CSS) injection vulnerability exists in Swagger UI prior to version 3.23.11 [1]. The application intentionally allows the embedding of untrusted JSON data from remote servers. It was discovered that the @import directive within JSON data can be used as an attack vector. By injecting a CSS import statement, an attacker can leverage the Relative Path Overwrite (RPO) technique to exfiltrate sensitive information from HTML input fields.

How is it exploited?

An attacker can craft a malicious JSON payload containing a @import rule and host it on a server under their control, or pass it via the url parameter in the Swagger UI query string [2]. When a victim visits a crafted link, Swagger UI loads the attacker's JSON, which triggers the browser to fetch the attacker's CSS file. Using RPO, the attacker can manipulate the CSS to read values from input fields, such as CSRF tokens, and send them to an external server.

Impact

Successful exploitation allows an attacker to extract CSRF tokens or other input field values [2]. With a CSRF token, the attacker can perform cross-site request forgery attacks on behalf of the victim, potentially leading to unauthorized actions. No authentication or direct user interaction beyond visiting the crafted URL is required.

Mitigation

The vulnerability is fixed in Swagger UI version 3.23.11 and later [1][3]. Users should upgrade to the latest version. Projects using Springfox or other libraries that bundle Swagger UI should also update their dependencies [3]. As a temporary workaround, avoid clicking on untrusted Swagger UI links, but upgrading is the recommended solution.