CVE-2023-46251: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value:  MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP ? Configuration ? Settings ? Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP ? Your Profile ? Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP ? Configuration ? Settings_):
- _Clickable Smilies and BB Code ? [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP ? Your Profile ? Edit Options_) _Show the MyCode formatting options on the posting pages_.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-11-06T18:15Z
Repository: https://github.com/mybb/mybb
Language: PHP
Files changed: admin/modules/user/users.php, install/resources/mybb_theme.xml, install/resources/upgrade58.php, jscripts/bbcodes_sceditor.js
Commit date: 2023-11-04 18:33:47 +0100
Commit message: Fix Visual editor size code persistent XSS

Diff: diff --git a/admin/modules/user/users.php b/admin/modules/user/users.php
index b057cccf8..6fa972cb8 100644
--- a/admin/modules/user/users.php
+++ b/admin/modules/user/users.php
@@ -941,11 +941,11 @@ if($mybb->input['action'] == "edit")
 
 	$page->extra_header .= <<<EOF
 
 	<link rel="stylesheet" href="../jscripts/sceditor/themes/mybb.css" type="text/css" media="all" />
 	<script type="text/javascript" src="../jscripts/sceditor/jquery.sceditor.bbcode.min.js?ver=1832"></script>
-	<script type="text/javascript" src="../jscripts/bbcodes_sceditor.js?ver=1832"></script>
+	<script type="text/javascript" src="../jscripts/bbcodes_sceditor.js?ver=1837"></script>
 	<script type="text/javascript" src="../jscripts/sceditor/plugins/undo.js?ver=1832"></script>
 EOF;
 	$page->output_header($lang->edit_user);
 
 	$sub_tabs['edit_user'] = array(
diff --git a/install/resources/mybb_theme.xml b/install/resources/mybb_theme.xml
index 73280de7d..140a9570e 100644
--- a/install/resources/mybb_theme.xml
+++ b/install/resources/mybb_theme.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<theme name="MyBB Master Style" version="1834">
+<theme name="MyBB Master Style" version="1837">
 	<properties>
 		<templateset><![CDATA[1]]></templateset>
 		<imgdir><![CDATA[images]]></imgdir>
 		<logo><![CDATA[images/logo.png]]></logo>
 		<tablespace><![CDATA[5]]></tablespace>
@@ -14157,13 +14157,13 @@ if(use_xmlhttprequest == "1")
 					</tr>]]></template>
 		<template name="attachment_icon" version="1800"><![CDATA[<img src="{$icon}" title="{$name}" border="0" alt=".{$ext}" />]]></template>		<template name="changeuserbox" version="1400"><![CDATA[<tr>
 <td class="trow1" width="20%"><strong>{$lang->username}</strong></td>
 <td class="trow1">{$mybb->user['username']} <span class="smalltext">[<strong><a href="member.php?action=logout&amp;logoutkey={$mybb->user['logoutkey']}">{$lang->change_user}</a></strong>]</span></td>
 </tr>]]></template>
-		<template name="codebuttons" version="1832"><![CDATA[<link rel="stylesheet" href="{$mybb->asset_url}/jscripts/sceditor/themes/{$theme['editortheme']}" type="text/css" media="all" />
+		<template name="codebuttons" version="1837"><![CDATA[<link rel="stylesheet" href="{$mybb->asset_url}/jscripts/sceditor/themes/{$theme['editortheme']}" type="text/css" media="all" />
 <script type="text/javascript" src="{$mybb->asset_url}/jscripts/sceditor/jquery.sceditor.bbcode.min.js?ver=1832"></script>
-<script type="text/javascript" src="{$mybb->asset_url}/jscripts/bbcodes_sceditor.js?ver=1832"></script>
+<script type="text/javascript" src="{$mybb->asset_url}/jscripts/bbcodes_sceditor.js?ver=1837"></script>
 <script type="text/javascript" src="{$mybb->asset_url}/jscripts/sceditor/plugins/undo.js?ver=1832"></script>
 <script type="text/javascript">
 var partialmode = {$mybb->settings['partialmode']},
 opt_editor = {
 	plugins: "undo",
diff --git a/install/resources/upgrade58.php b/install/resources/upgrade58.php
new file mode 100644
index 000000000..77ea0cc08
--- /dev/null
+++ b/install/resources/upgrade58.php
@@ -0,0 +1,21 @@
+<?php
+/**
+ * MyBB 1.8
+ * Copyright 2014 MyBB Group, All Rights Reserved
+ *
+ * Website: http://www.mybb.com
+ * License: http://www.mybb.com/about/license
+ *
+ */
+
+/**
+ * Upgrade Script: 1.8.34, 1.8.35 or 1.8.36
+ */
+
+$upgrade_detail = array(
+    "revert_all_templates" => 0,
+    "revert_all_themes" => 0,
+    "revert_all_settings" => 0
+);
+
+/* Nothing to do for 1.8.34, 1.8.35 or 1.8.36 */
diff --git a/jscripts/bbcodes_sceditor.js b/jscripts/bbcodes_sceditor.js
index 61700c47b..fbe4b8911 100644
--- a/jscripts/bbcodes_sceditor.js
+++ b/jscripts/bbcodes_sceditor.js
@@ -179,11 +179,11 @@ $(function ($) {
 		html: function (token, attrs, content) {
 			var size = 0,
 				units = "",
 				parsed = parseInt(attrs.defaultattr, 10);
 			if (!isNaN(parsed)) {
-				size = attrs.defaultattr;
+				size = parsed;
 				if (size < 1) {
 					size = 1;
 				} else if (size > 50) {
 					size = 50;
 				}

Vulnerable code: 	<script type="text/javascript" src="../jscripts/bbcodes_sceditor.js?ver=1832"></script>
<theme name="MyBB Master Style" version="1834">
		<template name="codebuttons" version="1832"><![CDATA[<link rel="stylesheet" href="{$mybb->asset_url}/jscripts/sceditor/themes/{$theme['editortheme']}" type="text/css" media="all" />
<script type="text/javascript" src="{$mybb->asset_url}/jscripts/bbcodes_sceditor.js?ver=1832"></script>
				size = attrs.defaultattr;
Fixed code: 	<script type="text/javascript" src="../jscripts/bbcodes_sceditor.js?ver=1837"></script>
<theme name="MyBB Master Style" version="1837">
		<template name="codebuttons" version="1837"><![CDATA[<link rel="stylesheet" href="{$mybb->asset_url}/jscripts/sceditor/themes/{$theme['editortheme']}" type="text/css" media="all" />
<script type="text/javascript" src="{$mybb->asset_url}/jscripts/bbcodes_sceditor.js?ver=1837"></script>
<?php
/**
 * MyBB 1.8
 * Copyright 2014 MyBB Group, All Rights Reserved
 *
 * Website: http://www.mybb.com
 * License: http://www.mybb.com/about/license
 *
 */

/**
 * Upgrade Script: 1.8.34, 1.8.35 or 1.8.36
 */

$upgrade_detail = array(
    "revert_all_templates" => 0,
    "revert_all_themes" => 0,
    "revert_all_settings" => 0
);

/* Nothing to do for 1.8.34, 1.8.35 or 1.8.36 */
				size = parsed;