High-Risk Vulnerability Issue in Swagger

Translated
1

Note:
This topic has been translated from a Chinese forum by GPT and might contain errors.

Original topic: Swagger 高危漏洞问题

| username: rw12306

The online security test detected a high-risk vulnerability in Swagger. How can this be resolved?

Could you please inform me of the location of the swagger/index.html file? Manually deleting it should resolve the issue.

2
| username: 会飞的土拨鼠 | Original post link

Is the high-risk vulnerability bug in Swagger located in the PD interface of the TiDB cluster? It is recommended to avoid database vulnerabilities. You can close some unnecessary ports, and generally, fixing it involves upgrading to a new version.

3
| username: rw12306 | Original post link

The machine running PD uses port 2379. If the port is closed, it will affect access, right? Can swagger be deleted? Just delete that HTML file.

4
| username: tidb菜鸟一只 | Original post link

Isn’t Swagger disabled by default in versions after 5.3.2?

5
| username: rw12306 | Original post link

I upgraded from 4.0, how do I disable it?

6
| username: tidb菜鸟一只 | Original post link

It seems that you need to add the parameter SWAGGER=1 when upgrading. I haven’t tried how to disable it once it’s enabled, but I haven’t enabled it on my side.

7
| username: rw12306 | Original post link

Where do you add parameters during the upgrade?

8
| username: ti-tiger | Original post link

Just close the port, right?

9
| username: tidb菜鸟一只 | Original post link

I looked at it again, do we need to manually add this parameter when compiling PD? There is indeed no place to specify this parameter when upgrading the entire cluster.

10
| username: h5n1 | Original post link

You can add a firewall to 2379 to block vulnerability scans.

11
| username: Billmay表妹 | Original post link
  1. During the upgrade, add the parameter SWAGGER=1 to disable it (it is enabled by default now). You can consider setting this when upgrading to version 5.3.4.
  2. If it is already enabled, you can add a firewall to set a whitelist.
12
| username: rw12306 | Original post link

Like this?

13
| username: Billmay表妹 | Original post link

It should be like this.

14
| username: Hacker_xUwtuKxa | Original post link

Your research is really in-depth. May I ask a simple question: what is the purpose of the swagger server?

15
| username: system | Original post link

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.