Swagger UI敏感信息泄露

漏洞定义

Swagger UI是一个交互式的、可视化的RESTful API文档工具，它允许开发人员快速浏览、测试API接口。Swagger UI通过读取由Swagger（也称为OpenAPI）规范定义的API描述文件（如swagger.json或swagger.yaml），自动生成易于理解的API文档，极大地简化了API的使用和测试过程。

                

漏洞危害

当Swagger UI的配置存在缺陷，如未设置访问控制、未启用严格的授权认证或直接在UI中展示敏感信息时，就可能导致敏感信息泄露。这种泄露是指未经授权的用户能够访问到原本应该受到保护的API文档和其中的敏感信息。

               

漏洞检测

访问Swagger UI未授权访问路径，可以通过BP抓包，然后再通过BP对该接口路径进行爆破

/api
/api-docs
/api-docs/swagger.json

                 

检测脚本

原理

使用域名拼接Swagger UI未授权访问路径（http://www.test.com/api-docs/swagger.json），然后模拟浏览器进行访问。若状态码200且页面长度大于0，则可能存在信息泄露，需要人工对检测结果进行最终的验证 。

                 

用法

python scanner.py urls.txt的文件路径

注意：检测结果不可避免的存在一些误报，需要人工对检测结果进行最终的验证 

                 

代码

api.txt

api-docs/swagger.json
actuator
actuator/./env
actuator/auditLog
actuator/auditevents
actuator/autoconfig
actuator/beans
actuator/caches
actuator/conditions
actuator/configurationMetadata
actuator/configprops
actuator/dump
actuator/env
actuator/events
actuator/exportRegisteredServices
actuator/features
actuator/flyway
actuator/health
actuator/healthcheck
actuator/httptrace
actuator/hystrix.stream
actuator/info
actuator/integrationgraph
actuator/jolokia
actuator/logfile
actuator/loggers
actuator/loggingConfig
actuator/liquibase
actuator/metrics
actuator/mappings
actuator/scheduledtasks
actuator/swagger-ui.html
actuator/prometheus
actuator/refresh
actuator/registeredServices
actuator/releaseAttributes
actuator/resolveAttributes
actuator/scheduledtasks
actuator/sessions
actuator/springWebflow
actuator/sso
actuator/ssoSessions
actuator/statistics
actuator/status
actuator/threaddump
actuator/trace
actuator/env.css
artemis-portal/artemis/env
artemis/api
artemis/api/env
auditevents
autoconfig
api
api.html
api/actuator
api/doc
api/index.html
api/swaggerui
api/swagger-ui.html
api/swagger
api/swagger/ui
api/v2/api-docs
api/v2;%0A/api-docs
api/v2;%252Ftest/api-docs
api-docs
beans
caches
cloudfoundryapplication
conditions
configprops
distv2/index.html
docs
doc.html
druid
druid/index.html
druid/login.html
druid/websession.html
dubbo-provider/distv2/index.html
dump
decision/login
entity/all
env
env.css
env/(name)
eureka
flyway
functionRouter
gateway/actuator
gateway/actuator/auditevents
gateway/actuator/beans
gateway/actuator/conditions
gateway/actuator/configprops
gateway/actuator/env
gateway/actuator/health
gateway/actuator/httptrace
gateway/actuator/hystrix.stream
gateway/actuator/info
gateway/actuator/jolokia
gateway/actuator/logfile
gateway/actuator/loggers
gateway/actuator/mappings
gateway/actuator/metrics
gateway/actuator/scheduledtasks
gateway/actuator/swagger-ui.html
gateway/actuator/threaddump
gateway/actuator/trace
gateway/routes
health
httptrace
hystrix
info
integrationgraph
jolokia
jolokia/list
jeecg/swagger-ui
jeecg/swagger/
libs/swaggerui
liquibase
list
logfile
loggers
liquibase
metrics
mappings
monitor
nacos
prod-api/actuator
prometheus
portal/conf/config.properties
portal/env/
refresh
scheduledtasks
sessions
spring-security-oauth-resource/swagger-ui.html
spring-security-rest/api/swagger-ui.html
static/swagger.json
sw/swagger-ui.html
swagger
swagger/codes
swagger/doc.json
swagger/index.html
swagger/static/index.html
swagger/swagger-ui.html
Swagger/ui/index
swagger/ui
swagger/v1/swagger.json
swagger/v2/swagger.json
swagger-dubbo/api-docs
swagger-resources
swagger-resources/configuration/ui
swagger-resources/configuration/security
swagger-ui
swagger-ui.html
swagger-ui.html;
swagger-ui/html
swagger-ui/index.html
system/druid/index.html
system/druid/webseesion.html
threaddump
template/swagger-ui.html
trace
users
user/swagger-ui.html
version
v1/api-docs/
v2/api-docs/
v3/api-docs/
v1/swagger-resources
v2/swagger-resources
v3/swagger-resources
v1.1/swagger-ui.html
v1.1;%0A/api-docs
v1.2/swagger-ui.html
v1.2;%0A/api-docs
v1.3/swagger-ui.html
v1.3;%0A/api-docs
v1.4/swagger-ui.html
v1.4;%0A/api-docs
v1.5/swagger-ui.html
v1.5;%0A/api-docs
v1.6/swagger-ui.html
v1.6;%0A/api-docs
v1.7/swagger-ui.html
v1.7;%0A/api-docs
v1.8/swagger-ui.html
v1.8;%0A/api-docs
v1.9/swagger-ui.html
v1.9;%0A/api-docs
v2.0/swagger-ui.html
v2.0;%0A/api-docs
v2.1/swagger-ui.html
v2.1;%0A/api-docs
v2.2/swagger-ui.html
v2.2;%0A/api-docs
v2.3/swagger-ui.html
v2.3;%0A/api-docs
v1/swagger.json
v2/swagger.json
v3/swagger.json
v2;%0A/api-docs
v3;%0A/api-docs
v2;%252Ftest/api-docs
v3;%252Ftest/api-docs
webpage/system/druid/websession.html
webpage/system/druid/index.html
webroot/decision/login
webjars/springfox-swagger-ui/swagger-ui-standalone-preset.js
webjars/springfox-swagger-ui/swagger-ui-standalone-preset.js?v=2.9.2
webjars/springfox-swagger-ui/springfox.js
webjars/springfox-swagger-ui/springfox.js?v=2.9.2
webjars/springfox-swagger-ui/swagger-ui-bundle.js
webjars/springfox-swagger-ui/swagger-ui-bundle.js?v=2.9.2
%20/swagger-ui.html

scanner.py

import sys
import requests
import pandas as pd
from typing import List, Dict, Any

scan_results: List[Dict[str, Any]] = []

def read_file(file_path):
    try:
        with open(file_path, 'r', encoding='utf-8') as file:  # 指定编码为utf-8
            lines = file.readlines()
        # 去除每行末尾的换行符和空行
        lines = [line.strip() for line in lines if line.strip()]
        return lines
    except FileNotFoundError:
        print(f"错误: {file_path} 文件不存在！")
        sys.exit(1)  # 退出程序并返回错误码1
    except IOError:
        print(f"错误: {file_path} 文件读取失败！")
        sys.exit(1)  # 退出程序并返回错误码1


def export_to_excel(data, file_name):
    df = pd.DataFrame(data)
    try:
        # 将DataFrame写入Excel文件，不包括索引
        df.to_excel(file_name, index=False)
        print(f"结果已写入文件： {file_name}")
    except IOError:
        print(f"结果写入出错： {file_name}.")


# 检查目标URL是否存在Swagger UI信息泄露，并返回相关信息
def check_swagger_ui(url):
    # 从api.txt文件中读取需要扫描的所有api
    api = read_file('api.txt')

    for a in api:
        full_url = url +'/'+ a #拼接成新的url
        try:
            # 发送GET请求到目标URL
            response = requests.get(full_url, timeout=5)
            status_code = response.status_code  # 获取状态码
            content_length = len(response.content)  # 获取页面长度（字节数）
            # 请求成功并且内容不为空
            if status_code == 200 and content_length > 0:
                print("True ：",full_url,"\t\t长度：",content_length)
                scan_results.append({'url': full_url, '状态':status_code,'漏洞': True,'长度': content_length})
            else:
                print("False：", full_url)
        except requests.RequestException as e:
            print("False：", full_url)


if __name__ == "__main__":
    # 如果提供了命令行参数，则使用它作为文件路径，否则使用默认路径
    if len(sys.argv) > 1:
        urls_path = sys.argv[1]
    else:
        # 默认文件路径，假设它与脚本在同一目录中
        urls_path = 'urls.txt'

    # 从urls.txt文件中读取需要扫描的所有url
    urls = read_file(urls_path)

    # 依次遍历需要扫描的url
    for url in urls:
        check_swagger_ui(url)

    # 将检测结果集导出为xlsx文档
    export_to_excel(scan_results, 'result.xlsx')