CVE-2022-4859: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-30T12:15Z
Repository: https://github.com/jogetworkflow/jw-community
Language: Java
Files changed: wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java
Commit date: 2022-11-23 09:04:01 +0800
Commit message: Fixed: wflow-core - User Profile Menu - Prevent XSS. T1604 @7.0-SNAPSHOT
Diff: diff --git a/wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java b/wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java
index 5d63d9518..a298b5814 100644
--- a/wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java
+++ b/wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java
@@ -12,10 +12,11 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 import org.joget.apps.app.service.AppUtil;
 import org.joget.apps.userview.model.UserviewBuilderPalette;
 import org.joget.apps.userview.model.UserviewMenu;
 import org.joget.commons.util.ResourceBundleUtil;
+import org.joget.commons.util.SecurityUtil;
 import org.joget.commons.util.SetupManager;
 import org.joget.commons.util.StringUtil;
 import org.joget.commons.util.TimeZoneUtil;
 import org.joget.directory.dao.UserDao;
 import org.joget.directory.model.User;
@@ -203,16 +204,16 @@ public class UserProfileMenu extends UserviewMenu {
                 } catch (Exception e) { }
             }
         }
         UserSecurity us = DirectoryUtil.getUserSecurity();
         
-        if ("".equals(getPropertyString("f_firstName"))) {
-            currentUser.setFirstName(getRequestParameterString("firstName"));
+        if ("".equals(getPropertyString("f_firstName")) && !StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")).isEmpty()) {
+            currentUser.setFirstName(StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")));
         }
 
         if ("".equals(getPropertyString("f_lastName"))) {
-            currentUser.setLastName(getRequestParameterString("lastName"));
+            currentUser.setLastName(StringUtil.stripAllHtmlTag(getRequestParameterString("lastName")));
         }
 
         if ("".equals(getPropertyString("f_email"))) {
             currentUser.setEmail(getRequestParameterString("email"));
         }

Vulnerable code:         if ("".equals(getPropertyString("f_firstName"))) {
            currentUser.setFirstName(getRequestParameterString("firstName"));
            currentUser.setLastName(getRequestParameterString("lastName"));
Fixed code: import org.joget.commons.util.SecurityUtil;
        if ("".equals(getPropertyString("f_firstName")) && !StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")).isEmpty()) {
            currentUser.setFirstName(StringUtil.stripAllHtmlTag(getRequestParameterString("firstName")));
            currentUser.setLastName(StringUtil.stripAllHtmlTag(getRequestParameterString("lastName")));