CVE-2023-3521: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-07-06T02:15Z
Repository: https://github.com/fossbilling/fossbilling
Language: PHP
Files changed: src/library/FOSSBilling/ErrorPage.php, src/load.php
Commit date: 2023-07-01 14:58:13 +0200
Commit message: Prevent exceptions from being interpreted as HTML (#1394)


Diff: diff --git a/src/library/FOSSBilling/ErrorPage.php b/src/library/FOSSBilling/ErrorPage.php
index 246b172a6..007f5093f 100644
--- a/src/library/FOSSBilling/ErrorPage.php
+++ b/src/library/FOSSBilling/ErrorPage.php
@@ -135,11 +135,11 @@ class ErrorPage
      * @return never
      */
     public function generatePage(int $code, string $message)
     {
         $error = $this->getCodeInfo($code);
-        $error['message'] ??= __trans('Uh-oh! You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
+        $error['message'] ??= __trans('You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
 
         $page = '
         <!DOCTYPE html>
         <html>
             <head>
diff --git a/src/load.php b/src/load.php
index 3de055744..37e62264a 100644
--- a/src/load.php
+++ b/src/load.php
@@ -150,20 +150,21 @@ function errorHandler(int $number, string $message, string $file, int $line)
 /*
  * Exception handler.
  */
 function exceptionHandler($e)
 {
+    $message = htmlspecialchars($e->getMessage());
     if (APPLICATION_ENV === 'testing') {
-        echo $e->getMessage() . PHP_EOL;
+        echo $message . PHP_EOL;
 
         return;
     }
-    error_log($e->getMessage());
+    error_log($message);
 
     if (defined('BB_MODE_API')) {
         $code = $e->getCode() ?: 9998;
-        $result = ['result' => null, 'error' => ['message' => $e->getMessage(), 'code' => $code]];
+        $result = ['result' => null, 'error' => ['message' => $message, 'code' => $code]];
         echo json_encode($result);
 
         return false;
     }
 
@@ -185,11 +186,11 @@ function exceptionHandler($e)
 
         echo $whoops->handleException($e);
     } else {
         include PATH_LIBRARY . DIRECTORY_SEPARATOR . 'FOSSBilling' . DIRECTORY_SEPARATOR . 'ErrorPage.php';
         $errorPage = new \FOSSBilling\ErrorPage();
-        $errorPage->generatePage($e->getCode(), $e->getMessage());
+        $errorPage->generatePage($e->getCode(), $message);
     }
 }
 
 /*
  *

Vulnerable code:         $error['message'] ??= __trans('Uh-oh! You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
        echo $e->getMessage() . PHP_EOL;
    error_log($e->getMessage());
        $result = ['result' => null, 'error' => ['message' => $e->getMessage(), 'code' => $code]];
        $errorPage->generatePage($e->getCode(), $e->getMessage());
Fixed code:         $error['message'] ??= __trans('You\'ve received a generic error message: :errorMessage', [':errorMessage' => '<code>' . $message . '</code>']);
    $message = htmlspecialchars($e->getMessage());
        echo $message . PHP_EOL;
    error_log($message);
        $result = ['result' => null, 'error' => ['message' => $message, 'code' => $code]];
        $errorPage->generatePage($e->getCode(), $message);