CVE-2013-4372: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2013-09-30T21:55Z
Repository: https://github.com/jboss-fuse/fuse
Language: Other
Files changed: fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee, fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee, fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee
Commit date: 2013-08-20 15:37:27 -0400
Commit message: FMC-495 FMC susceptible to cross site scripting issues

Diff: diff --git a/fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee b/fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee
index e038e9a2f..9f534dcd7 100644
--- a/fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee
+++ b/fmc/fmc-webui/src/main/webapp/app/controllers/patches_page.coffee
@@ -127,11 +127,11 @@ define [
           FON.model_backed_template
             model: model
             tagName: "option"
             attr:
               "value": model.id
-            template: _.template("#{model.id}")
+            template: _.template("#{FON.escapeHtml(model.id)}")
         on_render: =>
           super
           if @versions.get(@version.id)
             @version_select.val(@version.id)
           else
@@ -148,11 +148,11 @@ define [
         collection: @patch_files
         child_control: (model) ->
           FON.model_backed_template
             model: model
             tagName: "li"
-            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{model.id}""")
+            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{FON.escapeHtml(model.id)}""")
             elements:
               ".delete": "delete"
             on_render: (controller) ->
               controller.delete.click (event) ->
                 FON.confirm_delete(model.id, "patch", -> model.destroy()).render()
diff --git a/fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee b/fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee
index 25b100b4b..329d1196f 100644
--- a/fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee
+++ b/fmc/fmc-webui/src/main/webapp/app/controllers/profile_details_page.coffee
@@ -109,11 +109,11 @@ define [
         collection: @model
         child_control: (model) ->
           FON.model_backed_template
             model: model
             tagName: "li"
-            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{id}}</a>""")
+            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{FON.escapeHtml(id)}}</a>""")
             elements:
               ".delete": "delete"
               ".view": "view"
             on_render: (controller) ->
               controller.delete.click (event) ->
@@ -164,11 +164,11 @@ define [
         collection: @model.agents()
         child_control: (model) ->
           FON.model_backed_template
             model: model
             tagName: "li"
-            template: _.template('<a href=#/containers/{{id}}>{{id}}</a>')
+            template: _.template('<a href=#/containers/{{id}}>{{FON.escapeHtml(id)}}</a>')
 
 
   class ValueListEntry extends FON.TemplateController
     tagName: "li"
     template: jade["profiles_page/detail_page/value_list_entry.jade"]
diff --git a/fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee b/fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee
index 199de7fb2..f182ba15d 100644
--- a/fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee
+++ b/fmc/fmc-webui/src/main/webapp/app/controllers/users_page.coffee
@@ -135,11 +135,11 @@ define [
       @table.render()
 
   class RoleEntry extends FON.ModelBackedTemplate
     tagName:"li"
 
-    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{id}}""")
+    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{FON.escapeHtml(id)}}""")
     elements:
       "a.delete-role": "delete"
 
     on_render: ->
       @delete.click (event) =>

Vulnerable code:             template: _.template("#{model.id}")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{model.id}""")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{id}}</a>""")
            template: _.template('<a href=#/containers/{{id}}>{{id}}</a>')
    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{id}}""")
Fixed code:             template: _.template("#{FON.escapeHtml(model.id)}")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a>#{FON.escapeHtml(model.id)}""")
            template: _.template("""<a href="#" class="delete"><img src="img/x-16.png"></a><a href="#" class="view">{{FON.escapeHtml(id)}}</a>""")
            template: _.template('<a href=#/containers/{{id}}>{{FON.escapeHtml(id)}}</a>')
    template: _.template("""<a href="#" class="delete-role" title="Delete role"><img src="img/x-16.png"></a>{{FON.escapeHtml(id)}}""")