CVE-2015-0284: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in spacewalk-java in Spacewalk and Red Hat Satellite 5.7 allows remote authenticated users to inject arbitrary web script or HTML via crafted XML data to the XMLRPC API, involving user details.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7811.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2016-04-14T14:59Z
Repository: https://github.com/spacewalkproject/spacewalk
Language: Other
Files changed: backend/server/rhnPackage.py, java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp, java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp, java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp, java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf, java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf, java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf, java/code/webapp/WEB-INF/pages/groups/adminlist.jsp
Commit date: 2015-07-22 13:21:01 +0200
Commit message: 1181152 - XSS when altering user details and going somewhere where you are choosing user
        - Escaped tags in real names

Diff: diff --git a/backend/server/rhnPackage.py b/backend/server/rhnPackage.py
index fd9cd0fa8e..b8ee26daa6 100644
--- a/backend/server/rhnPackage.py
+++ b/backend/server/rhnPackage.py
@@ -201,11 +201,11 @@ def get_info_for_package(pkg, channel_id, org_id):
               'epoch': pkg[3],
               'arch': pkg[4],
               'channel_id': channel_id,
               'org_id': org_id}
     # yum repo has epoch="0" not only when epoch is "0" but also if it's NULL
-    if pkg[3] == '0' or pkg[3] == '':
+    if pkg[3] == '0' or pkg[3] == '' or pkg[3]==None:
         epochStatement = "(epoch is null or epoch = :epoch)"
     else:
         epochStatement = "epoch = :epoch"
     if params['org_id']:
         orgStatement = "org_id = :org_id"
diff --git a/java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp b/java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp
index 2de867c842..d76fcb087c 100644
--- a/java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp
+++ b/java/code/webapp/WEB-INF/pages/admin/multiorg/org_users.jsp
@@ -76,11 +76,11 @@
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="realname.displayname"
                    attr="userLastName">
-                <c:out value="${current.userDisplayName}" escapeXml="false" />
+                <c:out value="${current.userDisplayName}" escapeXml="true" />
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="orgadmin.displayname"
                    attr="orgAdmin">
diff --git a/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp b/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
index e640491a7e..5880d44115 100644
--- a/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
+++ b/java/code/webapp/WEB-INF/pages/admin/multiorg/sat_org_users.jsp
@@ -53,11 +53,11 @@
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="realname.displayname"
                    attr="userLastName">
-                <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="false"/>
+                <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="true"/>
         </rl:column>
         <rl:column bound="false"
                    sortable="false"
                    headerkey="org.displayname"
                    attr="orgName">
diff --git a/java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp b/java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp
index dd91fa5844..8fade0f934 100644
--- a/java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp
+++ b/java/code/webapp/WEB-INF/pages/admin/users/activelist.jsp
@@ -42,11 +42,11 @@
         <!-- Real name column -->
         <rl:column bound="false"
                    sortable="true"
                    headerkey="realname.displayname"
                    sortattr="userLastName">
-                <c:out value="${current.userLastName}, ${current.userFirstName}" />
+                <c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
         </rl:column>
 
         <!--  Roles column -->
         <rl:column attr="roleNames"
                    bound="true"
diff --git a/java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf b/java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf
index 619471bf54..1bec08c6bf 100644
--- a/java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf
+++ b/java/code/webapp/WEB-INF/pages/common/fragments/manage/managers.jspf
@@ -37,11 +37,11 @@
          </rl:column>
 
          <rl:column sortable="false"
             bound="false"
             headerkey="realname.displayname" >
-            ${current.userLastName}, ${current.userFirstName}
+            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
          </rl:column>
 
          <rl:column sortable="false"
             bound="false"
             headerkey="multiorg.jsp.email" >
diff --git a/java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf b/java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf
index 0ac6b3e961..24ed0e1d11 100644
--- a/java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf
+++ b/java/code/webapp/WEB-INF/pages/common/fragments/manage/subscribers.jspf
@@ -37,11 +37,11 @@
          </rl:column>
 
          <rl:column sortable="false"
             bound="false"
             headerkey="realname.displayname" >
-            ${current.userLastName}, ${current.userFirstName}
+            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
          </rl:column>
 
          <rl:column sortable="false"
             bound="false"
             headerkey="multiorg.jsp.email" >
diff --git a/java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf b/java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf
index 27944d08cc..f14bf856d5 100644
--- a/java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf
+++ b/java/code/webapp/WEB-INF/pages/common/fragments/user/userlist_columns.jspf
@@ -2,11 +2,11 @@
 
 <rl:column bound="false"
         sortable="true"
         headerkey="realname.displayname"
         sortattr="userLastName">
-        <c:out value="${current.userLastName}, ${current.userFirstName}" />
+        <c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
 </rl:column>
 
 <rl:column bound="true"
         headerkey="userdetails.jsp.roles"
         sortable="true"
diff --git a/java/code/webapp/WEB-INF/pages/groups/adminlist.jsp b/java/code/webapp/WEB-INF/pages/groups/adminlist.jsp
index dc5a606c13..33333f5582 100644
--- a/java/code/webapp/WEB-INF/pages/groups/adminlist.jsp
+++ b/java/code/webapp/WEB-INF/pages/groups/adminlist.jsp
@@ -48,11 +48,11 @@
          </rl:column>
 
          <rl:column sortable="false"
             bound="false"
             headerkey="realname.displayname" >
-            ${current.userLastName}, ${current.userFirstName}
+            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
          </rl:column>
 
          <rl:column sortable="true"
             sortattr="status"
             bound="false"

Vulnerable code:     if pkg[3] == '0' or pkg[3] == '':
                <c:out value="${current.userDisplayName}" escapeXml="false" />
                <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="false"/>
                <c:out value="${current.userLastName}, ${current.userFirstName}" />
            ${current.userLastName}, ${current.userFirstName}
            ${current.userLastName}, ${current.userFirstName}
        <c:out value="${current.userLastName}, ${current.userFirstName}" />
            ${current.userLastName}, ${current.userFirstName}
Fixed code:     if pkg[3] == '0' or pkg[3] == '' or pkg[3]==None:
                <c:out value="${current.userDisplayName}" escapeXml="true" />
                <c:out value="<a href=\"mailto:${current.address}\">${current.userLastName}, ${current.userFirstName}</a>" escapeXml="true"/>
                <c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />
        <c:out escapeXml="true" value="${current.userLastName}, ${current.userFirstName}" />
            <c:out escapeXml="true" value="${current.userLastName},${current.userFirstName}" />