Documentation
¶
Overview ¶
Package data holds embedded wordlists, content matchers, secret regexes, and the CVE registry that power SwaggerVu.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var SwaggerCVEs = []CVE{ { ID: "CVE-2025-8191", Title: "macrozheng Mall Swagger UI configUrl XSS", Affected: "macrozheng Mall 1.0.0 through 1.0.3", Description: "Application-specific configUrl XSS in macrozheng Mall's /swagger-ui/index.html integration. This is not a version-wide Swagger UI advisory.", Param: "configUrl", Technique: "application-specific-configUrl-xss", Reference: "https://nvd.nist.gov/vuln/detail/CVE-2025-8191", Testable: false, }, { ID: "CVE-2025-54432", Title: "Swagger UI remote-spec reflected XSS chain", Affected: "swagger-ui < 3.38.0 when the url option accepts remote definitions", Description: "A remote definition loaded through the url option can be combined with the historical DOMPurify bypass to create reflected XSS. Verification requires execution of SwaggerVu's tagged canary, not merely loading remote content.", Param: "url", Technique: "remote-spec-dompurify-xss", Reference: "https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx", Testable: true, }, { ID: "CVE-2018-25031", Title: "Swagger UI remote-definition spoofing", Affected: "swagger-ui <= 4.1.2; later/custom deployments may re-enable the option", Description: "The url option can display an attacker-controlled remote OpenAPI definition on a trusted documentation origin, enabling contextual spoofing or phishing. It is not, by itself, proof of XSS.", Param: "url", Technique: "remote-spec-spoofing", Reference: "https://nvd.nist.gov/vuln/detail/CVE-2018-25031", Testable: false, }, { ID: "CVE-2016-1000229", Title: "swagger-ui index.html DOM XSS", Affected: "swagger-ui 2.x", Description: "Historical Swagger UI XSS in spec key names. The current generic remote-description canary does not independently verify this technique.", Param: "", Technique: "spec-key-name-xss", Reference: "https://nvd.nist.gov/vuln/detail/CVE-2016-1000229", Testable: false, }, }
SwaggerCVEs is the curated registry used by the exploit module, newest first. Every entry is verified against a primary source. Only entries marked Testable have a matching confirmation path in internal/exploit.
var VersionRegex = regexp.MustCompile(`v?[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}`)
VersionRegex extracts a semantic version string from a matched page.
Functions ¶
func CVEsForParam ¶
CVEsForParam returns the IDs of every registry entry that uses the given param.
func InjectionParams ¶
func InjectionParams() []string
InjectionParams returns the distinct query parameters worth testing, in order.
func LooksLikeSwagger ¶
LooksLikeSwagger reports whether a response body contains a Swagger/OpenAPI marker.
func MatchedMarker ¶
MatchedMarker returns the first marker found, or "".
func Paths ¶
func Paths() []string
Paths returns the full, deduplicated discovery wordlist with priority paths first.
func PathsSorted ¶
func PathsSorted() []string
PathsSorted returns the wordlist sorted alphabetically (for --list-paths).
func PriorityPaths ¶
func PriorityPaths() []string
PriorityPaths returns only the high-signal subset.
Types ¶
type CVE ¶
type CVE struct {
ID string
Title string
Affected string
Description string
// Param is the query parameter abused to load an attacker-controlled spec.
Param string
// Technique is a narrow identifier for the advisory's actual mechanism.
Technique string
Reference string
// Testable is true only when the headless verifier has an independent,
// scanner-owned assertion for this exact advisory.
Testable bool
}
CVE describes a known Swagger/OpenAPI-tooling vulnerability and how SwaggerVu tests for it. PoCs are benign markers only — exploitation is opt-in and gated.
type SecretPattern ¶
SecretPattern is a named, compiled secret-detection regex.
func SecretPatterns ¶
func SecretPatterns() []SecretPattern
SecretPatterns returns the compiled secret-detection corpus.
Source Files