While using InfluxDB 2.7.11, we have detected an unauthorized access vulnerability affecting the Swagger API endpoint /api/v2/swagger.json. Could you please advise on solutions to block this endpoint? Thank you.

1

While using InfluxDB 2.7.11, we have detected an unauthorized access vulnerability affecting the Swagger API endpoint /api/v2/swagger.json. Could you please advise on solutions to block this endpoint? Thank you.

2

@scott，can you help me ?

3

Thanks for reaching out. The server serves a /docs page and it requires /api/v2/swagger.json for the API reference. Both of these currently serve without authorization, but /api/v2/swagger.json is static content and /docs simply prettifies that for the user (ie, nothing should be served that can’t be obtained from the influxdb/main-2.x repo). At the moment, if you don’t want to serve this content, you would need to use a proxy to block these routes as there isn’t currently a configuration flag to block these routes.

For InfluxData developers, AFAICS, the UI doesn’t link to these (neither main nor release/OSS) and at least influxdb-client-python, influxdb-client-js and telegraf do not use /api/v2/swagger.json. PR 11366 introduced this, but without a corresponding issue. It seems straightforward enough to conditionally serve this based on a new config option (similar to how we disable other development features).