CVE-2014-9432: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in templates/2k11/admin/overview.inc.tpl in Serendipity before 2.0-rc2 allow remote attackers to inject arbitrary web script or HTML via a blog comment in the QUERY_STRING to serendipity/index.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-12-31T22:59Z
Repository: https://github.com/s9y/Serendipity
Language: Other
Files changed: docs/NEWS, serendipity_config.inc.php, templates/2k11/admin/overview.inc.tpl
Commit date: 2014-12-23 11:10:53 +0100
Commit message: * Fixes escaping of comments in the new backend pane to prevent
      XSS. Thanks to Steffen Röemann for reporting!

Diff: diff --git a/docs/NEWS b/docs/NEWS
index 238b229a..b6afc488 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -1,7 +1,13 @@
 #
 
+Version 2.0-rc2 (December 23rd, 2014)
+------------------------------------------------------------------------
+
+    * Fixes escaping of comments in the new backend pane to prevent
+      XSS. Thanks to Steffen Röemann for reporting!
+
 Version 2.0-rc1 (includes beta4/5/6) (December 19th, 2014)
 ------------------------------------------------------------------------
 
     * entryproperties plugin will now automatically disable nl2br
       markup, when the WYSIWYG editor is used to create en entry
diff --git a/serendipity_config.inc.php b/serendipity_config.inc.php
index 1c11adb6..dc5ac55f 100644
--- a/serendipity_config.inc.php
+++ b/serendipity_config.inc.php
@@ -42,11 +42,11 @@ include(S9Y_INCLUDE_PATH . 'include/compat.inc.php');
 if (defined('USE_MEMSNAP')) {
     echo memSnap('Framework init');
 }
 
 // The version string
-$serendipity['version'] = '2.0-rc1';
+$serendipity['version'] = '2.0-rc2';
 
 
 // Setting this to 'false' will enable debugging output. All alpha/beta/cvs snapshot versions will emit debug information by default. To increase the debug level (to enable Smarty debugging), set this flag to 'debug'.
 if (!isset($serendipity['production'])) {
     $serendipity['production'] = ! preg_match('@\-(alpha|beta|cvs|rc).*@', $serendipity['version']);
diff --git a/templates/2k11/admin/overview.inc.tpl b/templates/2k11/admin/overview.inc.tpl
index 5cbe4327..9d021b33 100644
--- a/templates/2k11/admin/overview.inc.tpl
+++ b/templates/2k11/admin/overview.inc.tpl
@@ -37,13 +37,13 @@
 
             <ol class="plainList">
             {if is_array($comments)}
                 {foreach $comments as $comment}
                 <li class="clearfix"><b>{$comment.author|escape|truncate:30:"&hellip;"} {$CONST.IN} <a href="{$comment.entrylink}" title="Comment to {$comment.title}">#{$comment.id}</a></b>
-                    <div class="comment_summary">{$comment.body|truncate:100:"&hellip;"}</div>
+                    <div class="comment_summary">{$comment.body|escape|truncate:100:"&hellip;"}</div>
 
-                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody}</div>
+                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody|escape}</div>
                     
                     <ul class="plainList actions">
                         <li><a class="button_link" href="?serendipity[action]=admin&amp;serendipity[adminModule]=comments&amp;serendipity[adminAction]=edit&amp;serendipity[id]={$comment.id}&amp;serendipity[entry_id]={$comment.entry_id}&amp;{$urltoken}" title="{$CONST.EDIT}"><span class="icon-edit"></span><span class="visuallyhidden"> {$CONST.EDIT}</span></a></li>
                         <li><a class="button_link comments_reply" href="?serendipity[action]=admin&amp;serendipity[adminModule]=comments&amp;serendipity[adminAction]=reply&amp;serendipity[id]={$comment.id}&amp;serendipity[entry_id]={$comment.entry_id}&amp;serendipity[noBanner]=true&amp;serendipity[noSidebar]=true&amp;{$urltoken}" title="{$CONST.REPLY}"><span class="icon-chat"></span><span class="visuallyhidden"> {$CONST.REPLY}</span></a></li>
                     {if ($comment.status == 'pending') || ($comment.status == 'confirm')}

Vulnerable code: $serendipity['version'] = '2.0-rc1';
                    <div class="comment_summary">{$comment.body|truncate:100:"&hellip;"}</div>
                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody}</div>
Fixed code: Version 2.0-rc2 (December 23rd, 2014)
------------------------------------------------------------------------

    * Fixes escaping of comments in the new backend pane to prevent
      XSS. Thanks to Steffen Röemann for reporting!

$serendipity['version'] = '2.0-rc2';
                    <div class="comment_summary">{$comment.body|escape|truncate:100:"&hellip;"}</div>
                    <div id="c{$comment.id}_full" class="comment_full additional_info">{$comment.fullBody|escape}</div>