网站设计 配色,互联网营销和传统营销的区别,windows系统优化软件排行榜,遵义新闻头条Swagger UI敏感信息泄露
漏洞定义
Swagger UI是一个交互式的、可视化的RESTful API文档工具#xff0c;它允许开发人员快速浏览、测试API接口。Swagger UI通过读取由Swagger#xff08;也称为OpenAPI#xff09;规范定义的API描述文件#xff08;如swagger.json或swagger…Swagger UI敏感信息泄露
漏洞定义
Swagger UI是一个交互式的、可视化的RESTful API文档工具它允许开发人员快速浏览、测试API接口。Swagger UI通过读取由Swagger也称为OpenAPI规范定义的API描述文件如swagger.json或swagger.yaml自动生成易于理解的API文档极大地简化了API的使用和测试过程。 漏洞危害
当Swagger UI的配置存在缺陷如未设置访问控制、未启用严格的授权认证或直接在UI中展示敏感信息时就可能导致敏感信息泄露。这种泄露是指未经授权的用户能够访问到原本应该受到保护的API文档和其中的敏感信息。 漏洞检测
访问Swagger UI未授权访问路径可以通过BP抓包然后再通过BP对该接口路径进行爆破
/api
/api-docs
/api-docs/swagger.json 检测脚本
原理
使用域名拼接Swagger UI未授权访问路径http://www.test.com/api-docs/swagger.json然后模拟浏览器进行访问。若状态码200且页面长度大于0则可能存在信息泄露需要人工对检测结果进行最终的验证 。 用法
python scanner.py urls.txt的文件路径 注意检测结果不可避免的存在一些误报需要人工对检测结果进行最终的验证 代码 api.txt
api-docs/swagger.json
actuator
actuator/./env
actuator/auditLog
actuator/auditevents
actuator/autoconfig
actuator/beans
actuator/caches
actuator/conditions
actuator/configurationMetadata
actuator/configprops
actuator/dump
actuator/env
actuator/events
actuator/exportRegisteredServices
actuator/features
actuator/flyway
actuator/health
actuator/healthcheck
actuator/httptrace
actuator/hystrix.stream
actuator/info
actuator/integrationgraph
actuator/jolokia
actuator/logfile
actuator/loggers
actuator/loggingConfig
actuator/liquibase
actuator/metrics
actuator/mappings
actuator/scheduledtasks
actuator/swagger-ui.html
actuator/prometheus
actuator/refresh
actuator/registeredServices
actuator/releaseAttributes
actuator/resolveAttributes
actuator/scheduledtasks
actuator/sessions
actuator/springWebflow
actuator/sso
actuator/ssoSessions
actuator/statistics
actuator/status
actuator/threaddump
actuator/trace
actuator/env.css
artemis-portal/artemis/env
artemis/api
artemis/api/env
auditevents
autoconfig
api
api.html
api/actuator
api/doc
api/index.html
api/swaggerui
api/swagger-ui.html
api/swagger
api/swagger/ui
api/v2/api-docs
api/v2;%0A/api-docs
api/v2;%252Ftest/api-docs
api-docs
beans
caches
cloudfoundryapplication
conditions
configprops
distv2/index.html
docs
doc.html
druid
druid/index.html
druid/login.html
druid/websession.html
dubbo-provider/distv2/index.html
dump
decision/login
entity/all
env
env.css
env/(name)
eureka
flyway
functionRouter
gateway/actuator
gateway/actuator/auditevents
gateway/actuator/beans
gateway/actuator/conditions
gateway/actuator/configprops
gateway/actuator/env
gateway/actuator/health
gateway/actuator/httptrace
gateway/actuator/hystrix.stream
gateway/actuator/info
gateway/actuator/jolokia
gateway/actuator/logfile
gateway/actuator/loggers
gateway/actuator/mappings
gateway/actuator/metrics
gateway/actuator/scheduledtasks
gateway/actuator/swagger-ui.html
gateway/actuator/threaddump
gateway/actuator/trace
gateway/routes
health
httptrace
hystrix
info
integrationgraph
jolokia
jolokia/list
jeecg/swagger-ui
jeecg/swagger/
libs/swaggerui
liquibase
list
logfile
loggers
liquibase
metrics
mappings
monitor
nacos
prod-api/actuator
prometheus
portal/conf/config.properties
portal/env/
refresh
scheduledtasks
sessions
spring-security-oauth-resource/swagger-ui.html
spring-security-rest/api/swagger-ui.html
static/swagger.json
sw/swagger-ui.html
swagger
swagger/codes
swagger/doc.json
swagger/index.html
swagger/static/index.html
swagger/swagger-ui.html
Swagger/ui/index
swagger/ui
swagger/v1/swagger.json
swagger/v2/swagger.json
swagger-dubbo/api-docs
swagger-resources
swagger-resources/configuration/ui
swagger-resources/configuration/security
swagger-ui
swagger-ui.html
swagger-ui.html;
swagger-ui/html
swagger-ui/index.html
system/druid/index.html
system/druid/webseesion.html
threaddump
template/swagger-ui.html
trace
users
user/swagger-ui.html
version
v1/api-docs/
v2/api-docs/
v3/api-docs/
v1/swagger-resources
v2/swagger-resources
v3/swagger-resources
v1.1/swagger-ui.html
v1.1;%0A/api-docs
v1.2/swagger-ui.html
v1.2;%0A/api-docs
v1.3/swagger-ui.html
v1.3;%0A/api-docs
v1.4/swagger-ui.html
v1.4;%0A/api-docs
v1.5/swagger-ui.html
v1.5;%0A/api-docs
v1.6/swagger-ui.html
v1.6;%0A/api-docs
v1.7/swagger-ui.html
v1.7;%0A/api-docs
v1.8/swagger-ui.html
v1.8;%0A/api-docs
v1.9/swagger-ui.html
v1.9;%0A/api-docs
v2.0/swagger-ui.html
v2.0;%0A/api-docs
v2.1/swagger-ui.html
v2.1;%0A/api-docs
v2.2/swagger-ui.html
v2.2;%0A/api-docs
v2.3/swagger-ui.html
v2.3;%0A/api-docs
v1/swagger.json
v2/swagger.json
v3/swagger.json
v2;%0A/api-docs
v3;%0A/api-docs
v2;%252Ftest/api-docs
v3;%252Ftest/api-docs
webpage/system/druid/websession.html
webpage/system/druid/index.html
webroot/decision/login
webjars/springfox-swagger-ui/swagger-ui-standalone-preset.js
webjars/springfox-swagger-ui/swagger-ui-standalone-preset.js?v2.9.2
webjars/springfox-swagger-ui/springfox.js
webjars/springfox-swagger-ui/springfox.js?v2.9.2
webjars/springfox-swagger-ui/swagger-ui-bundle.js
webjars/springfox-swagger-ui/swagger-ui-bundle.js?v2.9.2
%20/swagger-ui.html
scanner.py
import sys
import requests
import pandas as pd
from typing import List, Dict, Anyscan_results: List[Dict[str, Any]] []def read_file(file_path):try:with open(file_path, r, encodingutf-8) as file: # 指定编码为utf-8lines file.readlines()# 去除每行末尾的换行符和空行lines [line.strip() for line in lines if line.strip()]return linesexcept FileNotFoundError:print(f错误: {file_path} 文件不存在)sys.exit(1) # 退出程序并返回错误码1except IOError:print(f错误: {file_path} 文件读取失败)sys.exit(1) # 退出程序并返回错误码1def export_to_excel(data, file_name):df pd.DataFrame(data)try:# 将DataFrame写入Excel文件不包括索引df.to_excel(file_name, indexFalse)print(f结果已写入文件 {file_name})except IOError:print(f结果写入出错 {file_name}.)# 检查目标URL是否存在Swagger UI信息泄露并返回相关信息
def check_swagger_ui(url):# 从api.txt文件中读取需要扫描的所有apiapi read_file(api.txt)for a in api:full_url url / a #拼接成新的urltry:# 发送GET请求到目标URLresponse requests.get(full_url, timeout5)status_code response.status_code # 获取状态码content_length len(response.content) # 获取页面长度字节数# 请求成功并且内容不为空if status_code 200 and content_length 0:print(True ,full_url,\t\t长度,content_length)scan_results.append({url: full_url, 状态:status_code,漏洞: True,长度: content_length})else:print(False, full_url)except requests.RequestException as e:print(False, full_url)if __name__ __main__:# 如果提供了命令行参数则使用它作为文件路径否则使用默认路径if len(sys.argv) 1:urls_path sys.argv[1]else:# 默认文件路径假设它与脚本在同一目录中urls_path urls.txt# 从urls.txt文件中读取需要扫描的所有urlurls read_file(urls_path)# 依次遍历需要扫描的urlfor url in urls:check_swagger_ui(url)# 将检测结果集导出为xlsx文档export_to_excel(scan_results, result.xlsx)
