GHSA-f36p-42jv-8rh2 Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
An XSS vulnerability in the bundled Swagger-UI allows attackers to achieve remote code execution and exfiltrate secrets in applications using Lithium with Swagger enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-f36p-42jv-8rh2?
GHSA-f36p-42jv-8rh2 is a cross-site scripting vulnerability in com.wire.bots:lithium, published on 30 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Impact
A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.
Patches
The used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df
Workarounds
The risk of injected external content can be reduced by setting up a Content-Security-Policy.
References
Credits
We thank Mohit Kumar for reporting this vulnerability!
Which versions are affected by GHSA-f36p-42jv-8rh2?
4 open source packages ship an affected version, including com.wire.bots:lithium and com.wire:lithium.
| Package | Affected | Fixed in |
|---|---|---|
com.wire.bots:lithium Maven | All versions | None |
com.wire.bots:lithium Maven | All versions | None |
com.wire:lithium Maven | All versions | 3.4.2 |
com.wire:lithium Maven | All versions | 3.4.2 |
How do I fix GHSA-f36p-42jv-8rh2?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-f36p-42jv-8rh2 being exploited?
There is no known exploitation of GHSA-f36p-42jv-8rh2 in the wild and no public exploit code.