Magento 2, XSS Patch not detected (APPSEC-2143)

Question

In Magento security scan I got the below message for my Magento instance:

XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143)

I am using Magento 2.2.3

How could I resolve this?

Is anyone have an idea about it?

Answer 1

I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml index b20da68..26ef484 100644 --- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml +++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml @@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl(); <div class="swagger-ui-wrap"> <a id="logo" href="http://swagger.io">swagger</a> <form id='api_selector'> - <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/> + <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/> <div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div> <div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div> </form>

Hope it will help some one

• Utsav Gupta: Thanks for your help. I tried the same in my instance and again check it with Magento Scanner but it is giving the same error. is there any other way?
• Sunil Patel: have you confirm that patch applied?
• Toto Memeng: Thanks for this answer, I spent 6 hours debugging the issue and finally fixed it. By the way I'm using Magento 2.2.5 this will help future Magento fellow people that you should patch this Magento swagger file and update the value to <?= $block->escapeUrl($schemaUrl) ?>. Thanks!

Answer 2

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

• Utsav Gupta: Thanks, @Dominic Xigen for your response, but we do not wanna upgrade version, is there any other way?