CVE-2023-4517: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-10-13T13:15Z
Repository: https://github.com/hestiacp/hestiacp
Language: PHP
Files changed: web/templates/pages/edit_server.php
Commit date: 2023-08-23 10:08:38 +0200
Commit message: Security patch for XSS in Edit server (#3946)

* Add htmlenties to backup forms

* Add some extra checks
Diff: diff --git a/web/templates/pages/edit_server.php b/web/templates/pages/edit_server.php
index 622d3167d5..5c287abe7b 100644
--- a/web/templates/pages/edit_server.php
+++ b/web/templates/pages/edit_server.php
@@ -510,11 +510,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_mysql_url"
 									id="v_mysql_url"
-									value="<?= $_SESSION["DB_PMA_ALIAS"] ?>"
+									value="<?= htmlentities($_SESSION["DB_PMA_ALIAS"]); ?>"
 								>
 							</div>
 							<div class="u-mb10">
 								<label for="v_phpmyadmin_key" class="form-label">
 									<?= _("phpMyAdmin Single Sign On") ?>
@@ -616,11 +616,11 @@
 							</div>
 							<div class="u-mb20">
 								<label for="v_pgsql_url" class="form-label">
 									<?= _("phpPgAdmin Alias") ?>
 								</label>
-								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= $_SESSION["DB_PGA_ALIAS"] ?>">
+								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= htmlentities($_SESSION["DB_PGA_ALIAS"]) ?>">
 							</div>
 						<?php } ?>
 						<?php if ($v_pgsql == "yes") {
 							$i = 0;
 							foreach ($v_pgsql_hosts as $value) {
@@ -725,11 +725,11 @@
 						<input
 							type="text"
 							class="form-control"
 							name="v_backup_dir"
 							id="v_backup_dir"
-							value="<?= trim($v_backup_dir, "'") ?>"
+							value="<?= htmlentities(trim($v_backup_dir, "'")) ?>"
 							disabled
 						>
 					</div>
 					<div class="form-check">
 						<input
@@ -783,11 +783,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_host"
 									id="v_backup_host"
-									value="<?= trim($v_backup_host, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_host, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb20">
 								<label for="v_backup_port" class="form-label">
 									<?= _("Port") ?>
@@ -795,11 +795,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_port"
 									id="v_backup_port"
-									value="<?= trim($v_backup_port, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_port, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb10">
 								<label for="v_backup_username" class="form-label">
 									<?= _("Username") ?>
@@ -807,11 +807,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_username"
 									id="v_backup_username"
-									value="<?= trim($v_backup_username, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_username, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb20">
 								<label for="v_backup_password" class="form-label">
 									<?= _("Password") ?>
@@ -820,11 +820,11 @@
 									<input
 										type="text"
 										class="form-control js-password-input"
 										name="v_backup_password"
 										id="v_backup_password"
-										value="<?= trim($v_backup_password, "'") ?>"
+										value="<?= htmlentities(trim($v_backup_password, "'")) ?>"
 									>
 								</div>
 							</div>
 							<div class="u-mb10">
 								<label for="v_backup_bpath" class="form-label">
@@ -833,11 +833,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_bpath"
 									id="v_backup_bpath"
-									value="<?= trim($v_backup_bpath, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_bpath, "'")) ?>"
 								>
 							</div>
 						</div>
 						<div x-cloak x-show="backupType == 'b2'">
 							<div class="u-mb10">
@@ -847,11 +847,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_bucket"
 									id="v_backup_bucket"
-									value="<?= trim($v_backup_bucket, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_bucket, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb10">
 								<label for="v_backup_application_id" class="form-label">
 									Key ID
@@ -859,11 +859,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_application_id"
 									id="v_backup_application_id"
-									value="<?= trim($v_backup_application_id, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_application_id, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb10">
 								<label for="v_backup_application_key" class="form-label">
 									Application Key
@@ -871,11 +871,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_backup_application_key"
 									id="v_backup_application_key"
-									value="<?= trim($v_backup_application_key, "'") ?>"
+									value="<?= htmlentities(trim($v_backup_application_key, "'")) ?>"
 								>
 							</div>
 						</div>
 						<div x-cloak x-show="backupType == 'rclone'">
 							<div class="u-mb10">
@@ -885,11 +885,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_rclone_host"
 									id="v_rclone_host"
-									value="<?= trim($v_rclone_host, "'") ?>"
+									value="<?= htmlentities(trim($v_rclone_host, "'")) ?>"
 								>
 							</div>
 							<div class="u-mb10">
 								<label for="v_rclone_path" class="form-label">
 									<?= _("Directory") ?>
@@ -897,11 +897,11 @@
 								<input
 									type="text"
 									class="form-control"
 									name="v_rclone_path"
 									id="v_rclone_path"
-									value="<?= trim($v_rclone_path, "'") ?>"
+									value="<?= htmlentities(trim($v_rclone_path, "'")) ?>"
 								>
 							</div>
 						</div>
 					</div>
 				</div>
@@ -944,37 +944,37 @@
 						><?= htmlentities(trim($v_ssl_key, "'")) ?></textarea>
 					</div>
 					<ul class="values-list">
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Issued To") ?></span>
-							<span class="values-list-value"><?= $v_ssl_subject ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_subject) ?></span>
 						</li>
 						<?php if ($v_ssl_aliases) { ?>
 							<li class="values-list-item">
 								<span class="values-list-label"><?= _("Alternate") ?></span>
-								<span class="values-list-value"><?= $v_ssl_aliases ?></span>
+								<span class="values-list-value"><?= htmlentities($v_ssl_aliases) ?></span>
 							</li>
 						<?php } ?>
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Not Before") ?></span>
-							<span class="values-list-value"><?= $v_ssl_not_before ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_not_before) ?></span>
 						</li>
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Not After") ?></span>
-							<span class="values-list-value"><?= $v_ssl_not_after ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_not_after) ?></span>
 						</li>
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Signature") ?></span>
-							<span class="values-list-value"><?= $v_ssl_signature ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_signature) ?></span>
 						</li>
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Key Size") ?></span>
-							<span class="values-list-value"><?= $v_ssl_pub_key ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_pub_key) ?></span>
 						</li>
 						<li class="values-list-item">
 							<span class="values-list-label"><?= _("Issued By") ?></span>
-							<span class="values-list-value"><?= $v_ssl_issuer ?></span>
+							<span class="values-list-value"><?= htmlentities($v_ssl_issuer) ?></span>
 						</li>
 					</ul>
 				</div>
 			</details>
 

Vulnerable code: 									value="<?= $_SESSION["DB_PMA_ALIAS"] ?>"
								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= $_SESSION["DB_PGA_ALIAS"] ?>">
							value="<?= trim($v_backup_dir, "'") ?>"
									value="<?= trim($v_backup_host, "'") ?>"
									value="<?= trim($v_backup_port, "'") ?>"
									value="<?= trim($v_backup_username, "'") ?>"
										value="<?= trim($v_backup_password, "'") ?>"
									value="<?= trim($v_backup_bpath, "'") ?>"
									value="<?= trim($v_backup_bucket, "'") ?>"
									value="<?= trim($v_backup_application_id, "'") ?>"
									value="<?= trim($v_backup_application_key, "'") ?>"
									value="<?= trim($v_rclone_host, "'") ?>"
									value="<?= trim($v_rclone_path, "'") ?>"
							<span class="values-list-value"><?= $v_ssl_subject ?></span>
								<span class="values-list-value"><?= $v_ssl_aliases ?></span>
							<span class="values-list-value"><?= $v_ssl_not_before ?></span>
							<span class="values-list-value"><?= $v_ssl_not_after ?></span>
							<span class="values-list-value"><?= $v_ssl_signature ?></span>
							<span class="values-list-value"><?= $v_ssl_pub_key ?></span>
							<span class="values-list-value"><?= $v_ssl_issuer ?></span>
Fixed code: 									value="<?= htmlentities($_SESSION["DB_PMA_ALIAS"]); ?>"
								<input type="text" class="form-control" name="v_pgsql_url" id="v_pgsql_url" value="<?= htmlentities($_SESSION["DB_PGA_ALIAS"]) ?>">
							value="<?= htmlentities(trim($v_backup_dir, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_host, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_port, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_username, "'")) ?>"
										value="<?= htmlentities(trim($v_backup_password, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_bpath, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_bucket, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_application_id, "'")) ?>"
									value="<?= htmlentities(trim($v_backup_application_key, "'")) ?>"
									value="<?= htmlentities(trim($v_rclone_host, "'")) ?>"
									value="<?= htmlentities(trim($v_rclone_path, "'")) ?>"
							<span class="values-list-value"><?= htmlentities($v_ssl_subject) ?></span>
								<span class="values-list-value"><?= htmlentities($v_ssl_aliases) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_not_before) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_not_after) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_signature) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_pub_key) ?></span>
							<span class="values-list-value"><?= htmlentities($v_ssl_issuer) ?></span>