PT-2022-28166 · Unknown · Http-Swagger

Published 2022-04-22 · Updated 2025-01-16 · CVE-2024-25712

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions http-swagger versions prior to 1.2.6

Description The issue allows an attacker to perform a denial-of-service (DOS) attack consisting of memory exhaustion on the host system and cross-site scripting (XSS) attacks by uploading malicious files. This is because a file uploaded via httpSwagger.WrapHandler and *webdav.memFile can be accessed later via a GET request.

Recommendations For versions prior to 1.2.6, please upgrade to v1.2.6 to resolve the issue. As a temporary workaround, consider restricting the path prefix to the "GET" method, as shown in the example code that sets up a router with the httpSwagger.Handler restricted to the http.MethodGet.

Exploit

Fix

Improper Handling of Exceptional Conditions

Resource Exhaustion

XSS

Weakness Enumeration

CWE-755

CWE-400

CWE-79

Related Identifiers

CVE-2024-25712

GHSA-49W7-5R33-JM9M

GHSA-XG75-Q3Q5-CQMV

GO-2022-0427

Affected Products

Http-Swagger

References · 15

• 🔥 https://cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html · Exploit
• https://osv.dev/vulnerability/GHSA-49w7-5r33-jm9m · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0427 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25712 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-24863 · Security Note
• https://osv.dev/vulnerability/GHSA-xg75-q3q5-cqmv · Vendor Advisory
• https://github.com/swaggo/http-swagger/issues/61 · Note
• https://github.com/swaggo/http-swagger/security/advisories/GHSA-xg75-q3q5-cqmv · Note
• https://github.com/swaggo/http-swagger/releases/tag/v1.2.6 · Note
• https://github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e · Note
• https://github.com/swaggo/http-swagger/pull/62 · Note
• https://github.com/swaggo/http-swagger · Note
• https://t.me/cvenotify/107650 · Telegram Post
• https://twitter.com/CVEnew/status/1756505137936318900 · Twitter Post