CVE-2022-24863: Denial of Service in http-swagger
Summary
CVE-2022-24863: Denial of Service in http-swagger. Affects github.com/swaggo/http-swagger versions < 1.2.6. Fixed in 1.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/swaggo/http-swagger, an open-source library written in Go. It provides functionality for integrating Swagger documentation into Go applications. The library allows users to generate Swagger documentation for their APIs and serve it through an HTTP endpoint. This vulnerability affects versions prior to v1.2.6 of the package.
Vulnerability Detail
The vulnerability in http-swagger allows an attacker to perform a Denial of Service (DoS) attack by exploiting a memory exhaustion issue on the host system. By sending specially crafted requests, an attacker can exhaust the available memory resources, leading to a system crash or unresponsiveness. This vulnerability poses a significant risk to the availability of the affected system.
How To Fix
Minimum fixed version
1.2.6
This is the first release that contains the fix.
go get github.com/swaggo/http-swagger@v1.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to restrict the path prefix to the 'GET' method. This can be achieved by modifying the code as follows:
func main() {
r := mux.NewRouter()
r.PathPrefix("/swagger/").Handler(httpSwagger.Handler(
httpSwagger.URL("http://localhost:1323/swagger/doc.json"),
httpSwagger.DeepLinking(true),
httpSwagger.DocExpansion("none"),
httpSwagger.DomID("#swagger-ui"),
)).Methods(http.MethodGet)
}
Conclusion
In conclusion, the http-swagger package prior to version 1.2.6 is vulnerable to a DoS attack that can exhaust memory resources on the host system. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/swaggo/http-swagger →
FAQ
The vulnerability allows an attacker to perform a DoS attack, leading to memory exhaustion on the host system. This can result in system crashes or unresponsiveness, impacting the availability of the affected system.
To mitigate this vulnerability, it is recommended to upgrade to version 1.2.6 of http-swagger. This version includes the necessary patches to address the DoS vulnerability.
Yes, a workaround is to restrict the path prefix to the 'GET' method. This can be achieved by modifying the code as shown in the 'workaround' section.
The vulnerability was reported by dongguangli from https://www.huoxian.cn/ company.
For more information, you can open an issue in the http-swagger GitHub repository: https://github.com/swaggo/http-swagger/issues
