Macrozheng Mall DOM-Based Cross-Site Scripting Vulnerability in Swagger UI

A cross-site scripting (XSS) vulnerability has been identified in Macrozheng Mall versions through 1.0.3. The issue resides in the Swagger UI component, specifically within the file '/swagger-ui/index.html'. The vulnerability is triggered by manipulating the 'configUrl' argument, allowing for remote exploitation. This issue was publicly disclosed, but the vendor removed the related GitHub issue without explanation and has not responded to further inquiries.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the Swagger UI interface and append the 'configUrl' parameter to the request URL with a link to a JSON file that contains a payload. This will trigger the XSS vulnerability by executing the injected script.