CVE-2022-0986: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-16T13:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: PHP
Files changed: web/edit/db/index.php, web/edit/dns/index.php, web/edit/mail/index.php, web/edit/web/index.php, web/templates/pages/edit_server.html
Commit date: 2022-03-14 09:31:39 +0100
Commit message: Patch out XSS  in edit server (#2471)


Diff: diff --git a/web/edit/db/index.php b/web/edit/db/index.php
index d7f059f701..f42f511cfa 100644
--- a/web/edit/db/index.php
+++ b/web/edit/db/index.php
@@ -13,10 +13,11 @@ if (empty($_GET['database'])) {
 }
 
 // Edit as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
     $user=escapeshellarg($_GET['user']);
+    $user_plain=htmlentities($_GET['user']);
 }
 
 // List datbase
 $v_database = $_GET['database'];
 exec(HESTIA_CMD."v-list-database ".$user." ".escapeshellarg($v_database)." 'json'", $output, $return_var);
diff --git a/web/edit/dns/index.php b/web/edit/dns/index.php
index e83c1bbbea..7dbaaef90b 100644
--- a/web/edit/dns/index.php
+++ b/web/edit/dns/index.php
@@ -13,10 +13,11 @@ if (empty($_GET['domain'])) {
 }
 
 // Edit as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
     $user=escapeshellarg($_GET['user']);
+    $user_plain=htmlentities($_GET['user']);
 }
 
 // List ip addresses
 exec(HESTIA_CMD."v-list-user-ips ".$user." json", $output, $return_var);
 $v_ips = json_decode(implode('', $output), true);
diff --git a/web/edit/mail/index.php b/web/edit/mail/index.php
index 7c2f016266..1aaead2737 100644
--- a/web/edit/mail/index.php
+++ b/web/edit/mail/index.php
@@ -13,10 +13,11 @@ if (empty($_GET['domain'])) {
 }
 
 // Edit as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
     $user=escapeshellarg($_GET['user']);
+    $user_plain=htmlentities($_GET['user']);
 }
 
 $v_username = $user;
 
 // List mail domain
diff --git a/web/edit/web/index.php b/web/edit/web/index.php
index 5a66a267ef..9d0362762f 100644
--- a/web/edit/web/index.php
+++ b/web/edit/web/index.php
@@ -14,10 +14,11 @@ if (empty($_GET['domain'])) {
 }
 
 // Edit as someone else?
 if (($_SESSION['userContext'] === 'admin') && (!empty($_GET['user']))) {
     $user=escapeshellarg($_GET['user']);
+    $user_plain=htmlentities($_GET['user']);
 }
 
 // Get all user domains
 exec(HESTIA_CMD."v-list-web-domains ".$user." json", $output, $return_var);
 $user_domains = json_decode(implode('', $output), true);
diff --git a/web/templates/pages/edit_server.html b/web/templates/pages/edit_server.html
index f2540cc75a..63b5a649b3 100644
--- a/web/templates/pages/edit_server.html
+++ b/web/templates/pages/edit_server.html
@@ -855,11 +855,11 @@
 							<td class="vst-text input-label step-left">
 								<table style="display:<?php if (empty($v_adv)) echo 'none';?> ;" id="ssl">
 									<tr>
 										<td class="vst-text step-top">
 											<?=_('SSL Certificate');?>
-											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_hostname?>"><?=_('Generate CSR');?></a></span>
+											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities(trim($v_hostname,'"'));?>"><?=_('Generate CSR');?></a></span>
 										</td>
 									</tr>
 									<tr>
 										<td>
 											<textarea size="20" class="vst-textinput short console" name="v_ssl_crt"><?=htmlentities(trim($v_ssl_crt, "'"))?></textarea>

Vulnerable code: 											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=$v_hostname?>"><?=_('Generate CSR');?></a></span>
Fixed code:     $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
    $user_plain=htmlentities($_GET['user']);
											<span id="generate-csr"> / <a class="generate" target="_blank" href="/generate/ssl/?domain=<?=htmlentities(trim($v_hostname,'"'));?>"><?=_('Generate CSR');?></a></span>