Hacking Swagger-UI - from XSS to account takeovers

We have reported more than 60 instances of this bug across a wide range of bug bounty programs including companies like Paypal, Atlassian, Microsoft, GitLab, Yahoo

Swagger-ui appears to require 'unsafe-eval' in CSP Headers · Issue #5817 · swagger-api/swagger-ui · GitHub

Untitled, PDF, Web Service

XSS Vulnerability with Swagger UI v3 · Issue #3847 · swagger-api/swagger-ui · GitHub

Found +6 DomXSS at different programs (Hacking Swagger-UI), by Adham sayed (doosec101)

How I was able to steal users credentials via Swagger UI DOM-XSS, by Mohamed reda

Hacking Swagger-UI - from XSS to account takeovers

Kelvin Wanja on LinkedIn: #hacking #hacking #development #bugbounty #bugbountytips

Hacking Swagger-UI - from XSS to account takeovers

Pratik Dabhi (@impratikdabhi) / X

Pawel Schulz na LinkedIn: #grafika #freelance

all tools on

How to Hack APIs in 2021 - Labs Detectify

Swagger-ui appears to require 'unsafe-eval' in CSP Headers · Issue #5817 · swagger-api/swagger-ui · GitHub