CVE-2021-25917: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2021-03-22T20:15Z
Repository: https://github.com/openemr/openemr
Language: PHP
Files changed: interface/orders/patient_match_dialog.php, interface/patient_file/report/patient_report.php, interface/usergroup/mfa_registrations.php, interface/usergroup/mfa_totp.php, interface/usergroup/mfa_u2f.php, interface/usergroup/usergroup_admin.php
Commit date: 2021-03-11 22:51:19 -0800
Commit message: bug fixes (#4280)


Diff: diff --git a/interface/orders/patient_match_dialog.php b/interface/orders/patient_match_dialog.php
index 85a9612692..f5f06fbc65 100644
--- a/interface/orders/patient_match_dialog.php
+++ b/interface/orders/patient_match_dialog.php
@@ -50,11 +50,11 @@ $form_DOB = $args['DOB'];
         return true;
     }
 
     function openPatient(ptid) {
         var f = opener.document.forms[0];
-        var ename = '<?php echo addslashes("select[$form_key]"); ?>';
+        var ename = <?php echo js_escape("select[$form_key]"); ?>;
         if (f[ename]) {
             f[ename].value = ptid;
             window.close();
         }
         else {
diff --git a/interface/patient_file/report/patient_report.php b/interface/patient_file/report/patient_report.php
index fed7fcd533..c87167cef0 100644
--- a/interface/patient_file/report/patient_report.php
+++ b/interface/patient_file/report/patient_report.php
@@ -327,11 +327,11 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                                             echo "<input type='checkbox' name='issue_" . attr($rowid) . "' id='issue_" . attr($rowid) . "' class='issuecheckbox' value='/";
                                             while ($ierow = sqlFetchArray($ieres)) {
                                                 echo attr($ierow['encounter']) . "/";
                                             }
 
-                                            echo "' />$disptitle</td>\n";
+                                            echo "' />" . text($disptitle) . "</td>\n";
                                             echo "     <td>" . text($prow['begdate']);
 
                                             if ($prow['enddate']) {
                                                 echo " - " . text($prow['enddate']);
                                             } else {
diff --git a/interface/usergroup/mfa_registrations.php b/interface/usergroup/mfa_registrations.php
index 87f386fc13..19b9883098 100644
--- a/interface/usergroup/mfa_registrations.php
+++ b/interface/usergroup/mfa_registrations.php
@@ -134,11 +134,11 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
             <div class="col-sm-12">
                 <form method='post' action='mfa_registrations.php' onsubmit='return top.restoreSession()'>
                     <input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" />
                     <div>
                         <fieldset>
-                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
+                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                             <table class='table'>
                                 <tr>
                                   <th align='left'>&nbsp;<?php echo xlt('Method'); ?>&nbsp;</th>
                                   <th align='left'>&nbsp;<?php echo xlt('Key Name'); ?>&nbsp;</th>
                                   <th align='left'>&nbsp;<?php echo xlt('Action'); ?>&nbsp;</th>
@@ -163,11 +163,11 @@ $oemr_ui = new OemrUI($arrOeUiSettings);
                             </table>
                         </fieldset>
                     </div>
                     <div>
                         <fieldset>
-                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
+                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                             <div class='col-sm-4 offset-sm-4'>
                                 <select name='form_add' onchange='addclick(this)'class='col-sm-12'>
                                     <option value=''><?php echo xlt('Add New...'); ?></option>
                                     <option value='U2F'><?php echo xlt('U2F USB Device'); ?></option>
                                     <option value='TOTP'
diff --git a/interface/usergroup/mfa_totp.php b/interface/usergroup/mfa_totp.php
index 92b8c3dfa8..81bc932a2b 100644
--- a/interface/usergroup/mfa_totp.php
+++ b/interface/usergroup/mfa_totp.php
@@ -107,11 +107,11 @@ $user_full_name = $user_name['fname'] . " " . $user_name['lname'];
                         if ($action == 'reg1') {
                             $error = (isset($_GET["error"])) ? $_GET["error"] : false;
                             ?>
                             <div>
                                 <fieldset>
-                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
+                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                     <div class="row">
                                         <div class="col-sm-12">
                                             <?php if ($error == "auth") { ?>
                                                 <div class="alert alert-danger alert-msg login-failure m-1">
                                                     <?php echo xlt('Invalid password'); ?>
@@ -168,11 +168,11 @@ $user_full_name = $user_name['fname'] . " " . $user_name['lname'];
                             if (!$doesExist) {
                                 $_SESSION['totpSecret'] = $googleAuth->getSecret();
                             }
                             ?>
                             <fieldset>
-                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
+                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                                 <div class="row">
                                     <div class="col-sm-12">
                                         <?php if (!$doesExist) { ?>
                                             <p>
                                                 <?php echo xlt('Scan the following QR code with your preferred authenticator app to register a new TOTP key.'); ?>
diff --git a/interface/usergroup/mfa_u2f.php b/interface/usergroup/mfa_u2f.php
index 262707a53c..9989e5aeec 100644
--- a/interface/usergroup/mfa_u2f.php
+++ b/interface/usergroup/mfa_u2f.php
@@ -99,11 +99,11 @@ function docancel() {
             list ($request, $signs) = $u2f->getRegisterData();
             ?>
         <div class="row">
             <div class="col-sm-12">
                 <fieldset>
-                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
+                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
                     <div class='col-sm-12'>
                         <p><?php echo xlt("Instructions");?>:
                             <ul>
                                 <li><?php echo xlt('This will register a new U2F USB key'); ?></li>
                                 <li><?php echo xlt('Type a name for your key, insert it into a USB port and click the Register button below'); ?></li>
diff --git a/interface/usergroup/usergroup_admin.php b/interface/usergroup/usergroup_admin.php
index debb1d2bbe..feb4936b00 100644
--- a/interface/usergroup/usergroup_admin.php
+++ b/interface/usergroup/usergroup_admin.php
@@ -275,16 +275,14 @@ if (isset($_POST["mode"])) {
         }
 
         $calvar = (!empty($_POST["calendar"])) ? 1 : 0;
         $portalvar = (!empty($_POST["portal_user"])) ? 1 : 0;
 
-        $res = sqlStatement("select distinct username from users where username != ''");
+        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
         $doit = true;
-        while ($row = sqlFetchArray($res)) {
-            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
-                $doit = false;
-            }
+        if (!empty($res['username'])) {
+            $doit = false;
         }
 
         if ($doit == true) {
             $insertUserSQL =
             "insert into users set " .

Vulnerable code:         var ename = '<?php echo addslashes("select[$form_key]"); ?>';
                                            echo "' />$disptitle</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . $user_full_name; ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . $user_full_name; ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . $user_full_name; ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . $user_full_name; ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . $user_full_name; ?></legend>
        $res = sqlStatement("select distinct username from users where username != ''");
        while ($row = sqlFetchArray($res)) {
            if ($doit == true && $row['username'] == trim($_POST['rumple'])) {
                $doit = false;
            }
Fixed code:         var ename = <?php echo js_escape("select[$form_key]"); ?>;
                                            echo "' />" . text($disptitle) . "</td>\n";
                            <legend><?php echo xlt('Current Authentication Method for') . " " . text($user_full_name); ?></legend>
                            <legend><?php echo xlt('Select/Add New Authentication Method for') . " " . text($user_full_name); ?></legend>
                                    <legend><?php echo xlt('Provide Password for') . " " . text($user_full_name); ?></legend>
                                <legend><?php echo xlt('Register TOTP Key for') . " " . text($user_full_name); ?></legend>
                    <legend><?php echo xlt('Register U2F Key for') . " " . text($user_full_name); ?></legend>
        $res = sqlQuery("select username from users where username = ?", [trim($_POST['rumple'])]);
        if (!empty($res['username'])) {
            $doit = false;