Relative Path Overwrite (RPO) SNYK-JS-SWAGGERUI-472935

[github-actions]

Overview

swagger-ui is a library that allows interaction and visualisation of APIs.

Affected versions of this package are vulnerable to Relative Path Overwrite (RPO). Attackers are able to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value i.e. allows the embedding of untrusted JSON data from remote servers, using <style>@import within the JSON data.

Remediation

Upgrade swagger-ui to version 3.23.11 or higher.

References

• GitHub Commit #2
• GitHub PR
• GitHub Release
• POC by crazykid95

[Bdegraaf1234]

not relevant anymore