CVE-2023-42817: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually.

CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-25T19:15Z
Repository: https://github.com/pimcore/admin-ui-classic-bundle
Language: JavaScript
Files changed: public/js/pimcore/functions.js, public/js/pimcore/settings/translation.js
Commit date: 2023-09-11 15:54:12 +0200
Commit message: [Bug]: Fix avoid recursion on replaced arguments having further % (#264)

* avoid recursion on replaced arguments having further %

* Update functions.js

* translation looks better lowercase in the mid of a phrase
Diff: diff --git a/public/js/pimcore/functions.js b/public/js/pimcore/functions.js
index 3e426a139..2680cfe8a 100644
--- a/public/js/pimcore/functions.js
+++ b/public/js/pimcore/functions.js
@@ -1622,12 +1622,15 @@ sprintf = function ()
             else if (pType == 'o') subst = parseInt(param).toString(8);
             else if (pType == 's') subst = param;
             else if (pType == 'x') subst = ('' + parseInt(param).toString(16)).toLowerCase();
             else if (pType == 'X') subst = ('' + parseInt(param).toString(16)).toUpperCase();
         }
-        str = leftpart + subst + rightPart;
+        arguments[numSubstitutions] = subst;
+        str = leftpart + '${'+numSubstitutions+'}' + rightPart;
     }
+    str = str.replace(/\${(\d+)}/g, (match, num) => arguments[num]);
+
     return str;
 }
 
 function array_merge () {
     // http://kevin.vanzonneveld.net
diff --git a/public/js/pimcore/settings/translation.js b/public/js/pimcore/settings/translation.js
index 4aa28ddc9..9b5853592 100644
--- a/public/js/pimcore/settings/translation.js
+++ b/public/js/pimcore/settings/translation.js
@@ -320,11 +320,11 @@ pimcore.settings.translation.domain = Class.create({
                 items: [{
                     tooltip: t('delete'),
                     icon: "/bundles/pimcoreadmin/img/flat-color-icons/delete.svg",
                     handler: function (grid, rowIndex) {
                         let data = grid.getStore().getAt(rowIndex);
-                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {
+                        pimcore.helpers.deleteConfirm(t('translation').toLowerCase(), Ext.util.Format.htmlEncode(data.data.key), function () {
                             grid.getStore().removeAt(rowIndex);
                         }.bind(this));
                     }.bind(this)
                 }]
             });

Vulnerable code:         str = leftpart + subst + rightPart;
                        pimcore.helpers.deleteConfirm(t('translation'), Ext.util.Format.htmlEncode(data.data.key), function () {
Fixed code:         arguments[numSubstitutions] = subst;
        str = leftpart + '${'+numSubstitutions+'}' + rightPart;
    str = str.replace(/\${(\d+)}/g, (match, num) => arguments[num]);

                        pimcore.helpers.deleteConfirm(t('translation').toLowerCase(), Ext.util.Format.htmlEncode(data.data.key), function () {