CVE-2023-2342: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-04-27T14:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js, models/WebsiteSetting.php
Commit date: 2023-04-20 15:23:18 +0200
Commit message: [Security] Fixed xss in website settings panel (#14957)

* fixed xss in website settings panel

* added `htmlspecialchars` to model

* added `SecurityHelper::convertHtmlSpecialChars`
Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js b/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
index 7f66651e70b2..1607daee09b9 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/settings/website.js
@@ -17,17 +17,15 @@ pimcore.settings.website = Class.create({
     initialize:function () {
 
         this.getTabPanel();
     },
 
-
     activate:function () {
         var tabPanel = Ext.getCmp("pimcore_panel_tabs");
         tabPanel.setActiveItem("pimcore_website_settings");
     },
 
-
     getTabPanel:function () {
 
         if (!this.panel) {
             this.panel = new Ext.Panel({
                 id:"pimcore_website_settings",
@@ -112,11 +110,15 @@ pimcore.settings.website = Class.create({
                 text: t("name"),
                 dataIndex: 'name',
                 flex: 100,
                 editable: true,
                 sortable: true,
-                editor: new Ext.form.TextField({})
+                editor: new Ext.form.TextField({
+                    listeners: {
+                        'change': pimcore.helpers.htmlEncodeTextField
+                    }
+                })
             },
             {
                 text: t('language'),
                 sortable: true,
                 dataIndex: "language",
@@ -131,11 +133,15 @@ pimcore.settings.website = Class.create({
             {
                 text: t("value"),
                 dataIndex: 'data',
                 flex: 300,
                 editable: true,
-                editor: new Ext.form.TextField({}),
+                editor: new Ext.form.TextField({
+                    listeners: {
+                        'change': pimcore.helpers.htmlEncodeTextField
+                    }
+                }),
                 renderer: this.getCellRenderer.bind(this),
             },
             {text: t("site"), flex: 100, sortable:true, dataIndex: "siteId",
                 editor: new Ext.form.ComboBox({
                     store: pimcore.globalmanager.get("sites"),
@@ -502,11 +508,10 @@ pimcore.settings.website = Class.create({
         }
         this.add(customKey.getValue(), customType.getValue(), false, false, false, true);
         this.customKeyField.setValue(null);
     },
 
-
     add: function (key, type, value, config, inherited, inheritable) {
 
         var store = this.grid.getStore();
 
         //this.cellEditing.editors.each(Ext.destroy, Ext);
diff --git a/models/WebsiteSetting.php b/models/WebsiteSetting.php
index bae728b45f96..a7bace70059d 100644
--- a/models/WebsiteSetting.php
+++ b/models/WebsiteSetting.php
@@ -16,10 +16,11 @@
 namespace Pimcore\Model;
 
 use Pimcore\Model\Element\ElementInterface;
 use Pimcore\Model\Element\Service;
 use Pimcore\Model\Exception\NotFoundException;
+use Pimcore\Security\SecurityHelper;
 
 /**
  * @method \Pimcore\Model\WebsiteSetting\Dao getDao()
  * @method void save()
  */
@@ -181,11 +182,11 @@ final class WebsiteSetting extends AbstractModel
      *
      * @return $this
      */
     public function setName($name)
     {
-        $this->name = $name;
+        $this->name = SecurityHelper::convertHtmlSpecialChars($name);
 
         return $this;
     }
 
     /**
@@ -226,11 +227,11 @@ final class WebsiteSetting extends AbstractModel
         if ($data instanceof ElementInterface) {
             $this->setType(Service::getElementType($data));
             $data = $data->getId();
         }
 
-        $this->data = $data;
+        $this->data = SecurityHelper::convertHtmlSpecialChars($data);
 
         return $this;
     }
 
     /**

Vulnerable code: 

                editor: new Ext.form.TextField({})
                editor: new Ext.form.TextField({}),

        $this->name = $name;
        $this->data = $data;
Fixed code:                 editor: new Ext.form.TextField({
                    listeners: {
                        'change': pimcore.helpers.htmlEncodeTextField
                    }
                })
                editor: new Ext.form.TextField({
                    listeners: {
                        'change': pimcore.helpers.htmlEncodeTextField
                    }
                }),
use Pimcore\Security\SecurityHelper;
        $this->name = SecurityHelper::convertHtmlSpecialChars($name);
        $this->data = SecurityHelper::convertHtmlSpecialChars($data);