{"id":"GHSA-f36p-42jv-8rh2","aliases":[],"status":"published","title":"Lithium vulnerable to Cross Site Scripting in provided Swagger-UI","description":"### Impact\r\nA  XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled.\r\nThis allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.\r\n\r\n\r\n### Patches\r\nThe used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df\r\n\r\n\r\n### Workarounds\r\nThe risk of injected external content can be reduced by setting up a [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).\r\n\r\n\r\n### References\r\n* https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/\r\n\r\n\r\n### Credits\r\nWe thank [Mohit Kumar](https://www.linkedin.com/in/mohit-kumar-4ab6b3bb) for reporting this vulnerability!","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-09-30T04:53:37Z","modified":"2024-11-28T05:29:07Z","fixes":[{"ecosystem":"Maven","package":"com.wire:lithium","fixed_in":["3.4.2"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.wire.bots:lithium","fixed_in":["3.4.2"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.wire:lithium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.wire.bots:lithium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.wire:lithium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.2"}]}],"versions":["3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3.7","3.4.0","3.4.1"]},{"source":"osv","ecosystem":"Maven","package":"com.wire.bots:lithium","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/wireapp/lithium/security/advisories/GHSA-f36p-42jv-8rh2","tags":["web"]},{"url":"https://github.com/wireapp/lithium/commit/8b9b406d608fe482ec0e7adf8705834bca92d7df","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f36p-42jv-8rh2"},{"url":"https://github.com/wireapp/lithium","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f36p-42jv-8rh2","title":"Lithium vulnerable to Cross Site Scripting in provided Swagger-UI","description":"### Impact\r\nA  XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled.\r\nThis allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.\r\n\r\n\r\n### Patches\r\nThe used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df\r\n\r\n\r\n### Workarounds\r\nThe risk of injected external content can be reduced by setting up a [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).\r\n\r\n\r\n### References\r\n* https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/\r\n\r\n\r\n### Credits\r\nWe thank [Mohit Kumar](https://www.linkedin.com/in/mohit-kumar-4ab6b3bb) for reporting this vulnerability!\r\n","status":"published","published":"2022-09-30T04:53:37Z","modified":"2023-01-12T05:05:13Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"osv":[{"id":"GHSA-f36p-42jv-8rh2","title":"Lithium vulnerable to Cross Site Scripting in provided Swagger-UI","description":"### Impact\nA  XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled.\nThis allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.\n\n\n### Patches\nThe used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df\n\n\n### Workarounds\nThe risk of injected external content can be reduced by setting up a [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).\n\n\n### References\n* https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/\n\n\n### Credits\nWe thank [Mohit Kumar](https://www.linkedin.com/in/mohit-kumar-4ab6b3bb) for reporting this vulnerability!\n","status":"published","published":"2022-09-30T04:53:37Z","modified":"2024-11-28T05:29:07.315369Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}