CVE-2023-3565: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-07-10T16:15Z
Repository: https://github.com/nilsteampassnet/teampass
Language: PHP
Files changed: includes/core/load.js.php, pages/options.php
Commit date: 2023-07-08 15:23:13 +0200
Commit message: 3.0.10

Fix possible xss

Diff: diff --git a/includes/core/load.js.php b/includes/core/load.js.php
index c6e049034f..4562405d03 100755
--- a/includes/core/load.js.php
+++ b/includes/core/load.js.php
@@ -1513,11 +1513,11 @@ if (
             );
 
             // Perform action
             $.when(
                 IncreaseSessionTime(
-                    $('#warningModal-input').val()
+                    fieldDomPurifierWithWarning('#warningModal-input')
                 )
             ).then(function() {
                 toastr.remove();
                 toastr.success(
                     '<?php echo langHdl('done'); ?>',
diff --git a/pages/options.php b/pages/options.php
index a534268fdf..1a087c5755 100755
--- a/pages/options.php
+++ b/pages/options.php
@@ -184,11 +184,11 @@ $zones = timezone_list();
                         <div class='row mb-2 option' data-keywords="server setting session expiration time">
                             <div class='col-10'>
                                 <?php echo langHdl('settings_default_session_expiration_time'); ?>
                             </div>
                             <div class='col-2 mb-2'>
-                                <input type='text' class='form-control form-control-sm' id='default_session_expiration_time' value='<?php echo $SETTINGS['default_session_expiration_time'] ?? '60'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='default_session_expiration_time' value='<?php echo $SETTINGS['default_session_expiration_time'] ?? '60'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="server setting ">
                             <div class='col-10'>
@@ -229,11 +229,11 @@ $zones = timezone_list();
                                 <small id='passwordHelpBlock' class='form-text text-muted'>
                                     <?php echo langHdl('admin_proxy_port_tip'); ?>
                                 </small>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='proxy_port' value='<?php echo $SETTINGS['proxy_port'] ?? '60'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='proxy_port' value='<?php echo $SETTINGS['proxy_port'] ?? '60'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="user ui setting login length password">
                             <div class='col-10'>
@@ -241,11 +241,11 @@ $zones = timezone_list();
                                 <small id='passwordHelpBlock' class='form-text text-muted'>
                                     <?php echo langHdl('admin_pwd_maximum_length_tip'); ?>
                                 </small>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='pwd_maximum_length' value='<?php echo $SETTINGS['pwd_maximum_length'] ?? '60'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='pwd_maximum_length' value='<?php echo $SETTINGS['pwd_maximum_length'] ?? '60'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="user ui setting time date">
                             <div class='col-4'>
@@ -330,20 +330,20 @@ $zones = timezone_list();
                         <div class='row mb-2 option' data-keywords="user login password duration">
                             <div class='col-10'>
                                 <?php echo langHdl('pw_life_duration'); ?>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='pw_life_duration' value='<?php echo $SETTINGS['pw_life_duration'] ?? '5'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='pw_life_duration' value='<?php echo $SETTINGS['pw_life_duration'] ?? '5'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="log user login password security">
                             <div class='col-10'>
                                 <?php echo langHdl('nb_false_login_attempts'); ?>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='nb_bad_authentication' value='<?php echo $SETTINGS['nb_bad_authentication'] ?? '0'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='nb_bad_authentication' value='<?php echo $SETTINGS['nb_bad_authentication'] ?? '0'; ?>'>
                             </div>
                         </div>
 
                         <!--
                         <div class='row mb-2 option' data-keywords="log user login">
@@ -498,11 +498,11 @@ $zones = timezone_list();
                                 <small id='passwordHelpBlock' class='form-text text-muted'>
                                     <?php echo langHdl('settings_delay_for_item_edition_tip'); ?>
                                 </small>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='delay_item_edition' value='<?php echo $SETTINGS['delay_item_edition'] ?? '9'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='delay_item_edition' value='<?php echo $SETTINGS['delay_item_edition'] ?? '9'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="one time">
                             <div class='col-10'>
@@ -516,11 +516,11 @@ $zones = timezone_list();
                         <div class='row mb-2 option' data-keywords="one time period expiration">
                             <div class='col-10'>
                                 <?php echo langHdl('settings_otv_expiration_period'); ?>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='otv_expiration_period' value='<?php echo $SETTINGS['otv_expiration_period'] ?? '7'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='otv_expiration_period' value='<?php echo $SETTINGS['otv_expiration_period'] ?? '7'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="right manager item">
                             <div class='col-10'>
@@ -543,11 +543,11 @@ $zones = timezone_list();
                         <div class='row mb-2 option' data-keywords="password last">
                             <div class='col-10'>
                                 <?php echo langHdl('max_last_items'); ?>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='max_last_items' value='<?php echo isset($SETTINGS['max_last_items']) === true ? $SETTINGS['max_last_items'] : '7'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='max_last_items' value='<?php echo isset($SETTINGS['max_last_items']) === true ? $SETTINGS['max_last_items'] : '7'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="create duplicate folder">
                             <div class='col-10'>
@@ -654,11 +654,11 @@ $zones = timezone_list();
                                 <small class='form-text text-muted'>
                                     <?php echo langHdl('password_overview_delay_tip'); ?>
                                 </small>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='password_overview_delay' value='<?php echo isset($SETTINGS['password_overview_delay']) === true ? $SETTINGS['password_overview_delay'] : '4'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='password_overview_delay' value='<?php echo isset($SETTINGS['password_overview_delay']) === true ? $SETTINGS['password_overview_delay'] : '4'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="password delete view expiration">
                             <div class='col-10'>
@@ -794,11 +794,11 @@ $zones = timezone_list();
                                 <small class='form-text text-muted'>
                                     <?php echo langHdl('clipboard_password_life_duration_tip'); ?>
                                 </small>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='clipboard_life_duration' value='<?php echo isset($SETTINGS['clipboard_life_duration']) === true ? $SETTINGS['clipboard_life_duration'] : '30'; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='clipboard_life_duration' value='<?php echo isset($SETTINGS['clipboard_life_duration']) === true ? $SETTINGS['clipboard_life_duration'] : '30'; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="display optimization description">
                             <div class='col-10'>
@@ -925,11 +925,11 @@ if (isset($SETTINGS['show_description']) === true && $SETTINGS['show_description
                         <div class='row mb-5 option' data-keywords="syslog port">
                             <div class='col-10'>
                                 <?php echo langHdl('syslog_port'); ?>
                             </div>
                             <div class='col-2'>
-                                <input type='text' class='form-control form-control-sm' id='syslog_port' value='<?php echo isset($SETTINGS['syslog_port']) === true ? $SETTINGS['syslog_port'] : ''; ?>'>
+                                <input type='number' class='form-control form-control-sm' id='syslog_port' value='<?php echo isset($SETTINGS['syslog_port']) === true ? $SETTINGS['syslog_port'] : ''; ?>'>
                             </div>
                         </div>
 
                         <div class='row mb-2 option' data-keywords="password server">
                             <div class='col-10'>

Vulnerable code:                     $('#warningModal-input').val()
                                <input type='text' class='form-control form-control-sm' id='default_session_expiration_time' value='<?php echo $SETTINGS['default_session_expiration_time'] ?? '60'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='proxy_port' value='<?php echo $SETTINGS['proxy_port'] ?? '60'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='pwd_maximum_length' value='<?php echo $SETTINGS['pwd_maximum_length'] ?? '60'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='pw_life_duration' value='<?php echo $SETTINGS['pw_life_duration'] ?? '5'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='nb_bad_authentication' value='<?php echo $SETTINGS['nb_bad_authentication'] ?? '0'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='delay_item_edition' value='<?php echo $SETTINGS['delay_item_edition'] ?? '9'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='otv_expiration_period' value='<?php echo $SETTINGS['otv_expiration_period'] ?? '7'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='max_last_items' value='<?php echo isset($SETTINGS['max_last_items']) === true ? $SETTINGS['max_last_items'] : '7'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='password_overview_delay' value='<?php echo isset($SETTINGS['password_overview_delay']) === true ? $SETTINGS['password_overview_delay'] : '4'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='clipboard_life_duration' value='<?php echo isset($SETTINGS['clipboard_life_duration']) === true ? $SETTINGS['clipboard_life_duration'] : '30'; ?>'>
                                <input type='text' class='form-control form-control-sm' id='syslog_port' value='<?php echo isset($SETTINGS['syslog_port']) === true ? $SETTINGS['syslog_port'] : ''; ?>'>
Fixed code:                     fieldDomPurifierWithWarning('#warningModal-input')
                                <input type='number' class='form-control form-control-sm' id='default_session_expiration_time' value='<?php echo $SETTINGS['default_session_expiration_time'] ?? '60'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='proxy_port' value='<?php echo $SETTINGS['proxy_port'] ?? '60'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='pwd_maximum_length' value='<?php echo $SETTINGS['pwd_maximum_length'] ?? '60'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='pw_life_duration' value='<?php echo $SETTINGS['pw_life_duration'] ?? '5'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='nb_bad_authentication' value='<?php echo $SETTINGS['nb_bad_authentication'] ?? '0'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='delay_item_edition' value='<?php echo $SETTINGS['delay_item_edition'] ?? '9'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='otv_expiration_period' value='<?php echo $SETTINGS['otv_expiration_period'] ?? '7'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='max_last_items' value='<?php echo isset($SETTINGS['max_last_items']) === true ? $SETTINGS['max_last_items'] : '7'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='password_overview_delay' value='<?php echo isset($SETTINGS['password_overview_delay']) === true ? $SETTINGS['password_overview_delay'] : '4'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='clipboard_life_duration' value='<?php echo isset($SETTINGS['clipboard_life_duration']) === true ? $SETTINGS['clipboard_life_duration'] : '30'; ?>'>
                                <input type='number' class='form-control form-control-sm' id='syslog_port' value='<?php echo isset($SETTINGS['syslog_port']) === true ? $SETTINGS['syslog_port'] : ''; ?>'>