Cross-Site Scripting in macrozheng mall Swagger UI configUrl Handling

The repository contains one YAML-formatted Swagger 2.0 specification stored as test.json. Its sole purpose is to embed a malformed HTML/MathML/SVG payload in info.description. When a vulnerable Swagger/OpenAPI documentation renderer injects this description into the DOM without effective sanitization, the payload attempts to create an image with an onerror handler that runs alert(window.origin). This is a browser-side XSS proof of concept, not a network exploit or a detection-only script. The specification also declares a GET /accounts operation (operationId findAccounts), but no executable client code requests that endpoint.

This repository contains three YAML files (alert.yaml, alert2.yaml, alert3.yaml), each formatted as a Swagger/OpenAPI specification with a malicious payload in the 'title' field of the 'info' section. The payloads are crafted to execute JavaScript (alert popups or DOM modification) if the title is rendered as HTML in a vulnerable Swagger/OpenAPI documentation viewer or parser. The exploit demonstrates proof-of-concept XSS attacks targeting applications that do not properly sanitize the 'title' field when displaying API documentation. There are no network endpoints or hardcoded IPs; the exploit is file-based and relies on browser-based attack vectors. The repository is structured simply, with each file serving as a standalone XSS proof-of-concept.

This repository is a proof-of-concept (PoC) exploit for CVE-2025-8191, targeting Swagger UI's ability to load external configuration files via the configURL parameter. The exploit consists of three files: a README.md with usage instructions and a vulnerable endpoint, a test.json file that acts as a malicious Swagger config referencing a crafted YAML file, and test.yaml, which contains a Swagger definition with an HTML injection payload. The payload injects a fake login form into the Swagger UI interface, demonstrating the risk of arbitrary HTML injection. The exploit does not provide a shell or code execution, but proves the ability to inject and display arbitrary HTML to users of the Swagger UI. The main attack vector is through a browser by tricking a user or administrator into loading the malicious config file in their Swagger UI instance.

This repository provides a proof-of-concept exploit for CVE-2025-8191, a Cross-Site Scripting (XSS) vulnerability in Swagger UI versions 1.0.3 and below. The exploit is implemented in C (exploit.c) and generates a malicious Swagger configuration file (xss.json) with a JavaScript payload in the 'description' field. When this file is loaded by a vulnerable Swagger UI instance, the payload executes in the victim's browser, exfiltrating cookies to an attacker-controlled server. The exploit requires the attacker to specify both the target Swagger UI URL and their own server for data exfiltration. The repository includes a README with usage instructions and a LICENSE file. The main exploit logic is in exploit.c, which handles argument parsing, payload file creation, and sending the exploit request to the target.