CVE-2023-27054: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter under the settings module.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-03-22T22:15Z
Repository: https://github.com/miroslavpejic85/mirotalk
Language: JavaScript
Files changed: public/js/client.js, public/views/client.html
Commit date: 2023-02-18 19:27:05 +0100
Commit message: [mirotalk] - #139 prevent XSS through DC

Diff: diff --git a/public/js/client.js b/public/js/client.js
index 2e319d7..ad56c1b 100644
--- a/public/js/client.js
+++ b/public/js/client.js
@@ -4660,14 +4660,17 @@ function sendChatMessage() {
     cleanMessageInput();
 }
 
 /**
  * handle Incoming Data Channel Chat Messages
- * @param {object} dataMessage chat messages
+ * @param {object} data chat messages
  */
-function handleDataChannelChat(dataMessage) {
-    if (!dataMessage) return;
+function handleDataChannelChat(data) {
+    if (!data) return;
+
+    // prevent XSS injection from remote peer through Data Channel
+    const dataMessage = JSON.parse(filterXSS(JSON.stringify(data)));
 
     let msgFrom = dataMessage.from;
     let msgTo = dataMessage.to;
     let msg = dataMessage.msg;
     let msgPrivate = dataMessage.privateMsg;
@@ -4978,16 +4981,18 @@ function addMsgerPrivateBtn(msgerPrivateBtn, msgerPrivateMsgInput, peerId) {
     msgerPrivateMsgInput.onpaste = () => {
         isChatPasteTxt = true;
     };
 
     function sendPrivateMessage() {
-        let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
-        if (!pMsg) {
-            msgerPrivateMsgInput.value = '';
-            isChatPasteTxt = false;
-            return;
-        }
+        let pMsg = msgerPrivateMsgInput.value.trim();
+
+        // let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
+        // if (!pMsg) {
+        //     msgerPrivateMsgInput.value = '';
+        //     isChatPasteTxt = false;
+        //     return;
+        // }
         let toPeerName = msgerPrivateBtn.value;
         emitMsg(myPeerName, toPeerName, pMsg, true, peerId);
         appendMessage(myPeerName, rightChatAvatar, 'right', pMsg + '<hr>Private message to ' + toPeerName, true);
         msgerPrivateMsgInput.value = '';
         msgerCP.style.display = 'none';
diff --git a/public/views/client.html b/public/views/client.html
index d22cc93..0e5807b 100755
--- a/public/views/client.html
+++ b/public/views/client.html
@@ -474,19 +474,21 @@ access to use this app.
 
         <!--
         - JS scripts https://cdn.jsdelivr.net
         
         - https://webrtc.github.io/adapter/adapter-latest.js                (https://github.com/webrtcHacks/adapter)
+        - https://github.com/leizongmin/js-xss                              (https://www.npmjs.com/package/xss)
         - https://www.npmjs.com/package/marked                              (https://github.com/markedjs/marked)
         - https://www.npmjs.com/package/detectrtc                           (https://github.com/muaz-khan/DetectRTC)
         - https://www.npmjs.com/package/sweetalert2                         (https://github.com/sweetalert2/sweetalert2)
         - https://www.npmjs.com/package/fabric                              (https://github.com/fabricjs/fabric.js)
         - https://www.npmjs.com/package/qrious                              (https://github.com/neocotic/qrious)
         - https://cdn.jsdelivr.net/npm/emoji-mart@latest/dist/browser.js    (https://github.com/missive/emoji-mart)
         - https://www.npmjs.com/package/tippy.js                            (https://github.com/atomiks/tippyjs) 
         -->
         <script defer src="https://webrtc.github.io/adapter/adapter-latest.js"></script>
+        <script defer src="https://rawgit.com/leizongmin/js-xss/master/dist/xss.js"></script>
         <script defer src="https://cdn.jsdelivr.net/npm/marked/marked.min.js"></script>
         <script defer src="https://cdn.jsdelivr.net/npm/detectrtc@1.4.1/DetectRTC.min.js"></script>
         <script defer src="https://cdn.jsdelivr.net/npm/sweetalert2@11.7.1"></script>
         <script defer src="https://cdn.jsdelivr.net/npm/fabric@5.3.0-browser/dist/fabric.min.js"></script>
         <script defer src="https://cdn.jsdelivr.net/npm/qrious@4.0.2/dist/qrious.min.js"></script>

Vulnerable code:  * @param {object} dataMessage chat messages
function handleDataChannelChat(dataMessage) {
    if (!dataMessage) return;
        let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
        if (!pMsg) {
            msgerPrivateMsgInput.value = '';
            isChatPasteTxt = false;
            return;
        }
Fixed code:  * @param {object} data chat messages
function handleDataChannelChat(data) {
    if (!data) return;

    // prevent XSS injection from remote peer through Data Channel
    const dataMessage = JSON.parse(filterXSS(JSON.stringify(data)));
        let pMsg = msgerPrivateMsgInput.value.trim();

        // let pMsg = checkMsg(msgerPrivateMsgInput.value.trim());
        // if (!pMsg) {
        //     msgerPrivateMsgInput.value = '';
        //     isChatPasteTxt = false;
        //     return;
        // }
        - https://github.com/leizongmin/js-xss                              (https://www.npmjs.com/package/xss)
        <script defer src="https://rawgit.com/leizongmin/js-xss/master/dist/xss.js"></script>