CVE-2016-15032: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This affects the function stopOutput of the file class.tx_mhhttpbl.php. The manipulation of the argument $_SERVER['REMOTE_ADDR'] leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is named a754bf306a433a8c18b55e25595593e8f19b9463. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230391. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-02T00:15Z
Repository: https://github.com/mback2k/mh_httpbl
Language: PHP
Files changed: class.tx_mhhttpbl.php
Commit date: 2016-05-26 17:43:09 +0200
Commit message: Fix possible Cross-Site Scripting by escaping remote addr and host

Thanks to Nicole Cordes of the TYPO3 Security Team.

Diff: diff --git a/class.tx_mhhttpbl.php b/class.tx_mhhttpbl.php
index 36ef997..2309868 100644
--- a/class.tx_mhhttpbl.php
+++ b/class.tx_mhhttpbl.php
@@ -136,16 +136,20 @@ class tx_mhhttpbl {
 	function stopOutput() {
 		if ($this->debug)
 			t3lib_div::devlog('blocking user: ' . $_SERVER['REMOTE_ADDR'], $this->extKey, 1);
 
 		$remote_addr = $_SERVER['REMOTE_ADDR'];
+		$remote_host = gethostbyaddr($remote_addr);
+		$remote_addr_html = htmlspecialchars($remote_addr);
+		$remote_host_html = htmlspecialchars($remote_host);
+
 		$GLOBALS['TYPO3_DB']->exec_INSERTquery('tx_mhhttpbl_blocklog', array('crdate'=>time(), 'tstamp'=>time(), 'block_ip'=>$remote_addr, 'block_type'=>$this->type, 'block_score'=>$this->score));
 
 		$usrHash = t3lib_div::shortMD5(serialize($_SERVER));
 		$stdMsg = "<strong>You have been blocked.</strong><br />Your IP appears to be on the httpbl.org/projecthoneypot.org blacklist.<br /><br />###REQUEST_IP###<br /><br />###USER_TYPE###";
 		$message = (!empty($this->config['message']) ? $stdMsg : $this->pObj->csConvObj->utf8_encode($message, $this->pObj->renderCharset));
-		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr . '</strong> (' . gethostbyaddr($remote_addr) . ')', $message);
+		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr_html . '</strong> (' . $remote_host_html . ')', $message);
 		$message = str_replace('###USER_TYPE###', $this->codes[$this->type], $message);
 
 		$this->pObj->fe_user->setKey('ses','tx_mhhttpbl_hash', $usrHash);
 		$this->pObj->fe_user->setKey('ses','tx_mhhttpbl_user', false);
 		$this->pObj->fe_user->storeSessionData();
@@ -228,6 +232,6 @@ class tx_mhhttpbl {
 
 if (defined('TYPO3_MODE') && $TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['ext/mh_httpbl/class.tx_mhhttpbl.php']) {
 	include_once($TYPO3_CONF_VARS[TYPO3_MODE]['XCLASS']['ext/mh_httpbl/class.tx_mhhttpbl.php']);
 }
 
-?>
\ No newline at end of file
+?>

Vulnerable code: 		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr . '</strong> (' . gethostbyaddr($remote_addr) . ')', $message);
?>
Fixed code: 		$remote_host = gethostbyaddr($remote_addr);
		$remote_addr_html = htmlspecialchars($remote_addr);
		$remote_host_html = htmlspecialchars($remote_host);

		$message = str_replace('###REQUEST_IP###', '<strong>' . $remote_addr_html . '</strong> (' . $remote_host_html . ')', $message);
?>