CVE-2023-28106: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-03-16T17:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php, bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js, bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
Commit date: 2023-03-15 15:15:38 +0100
Commit message: optimized urlslug input (#14669)


Diff: diff --git a/bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php b/bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php
index 712cdc852511..de5ab45c1c29 100644
--- a/bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php
+++ b/bundles/AdminBundle/Controller/Admin/Document/DocumentControllerBase.php
@@ -160,10 +160,15 @@ abstract class DocumentControllerBase extends AdminController implements KernelC
     {
         // settings
         if ($request->get('settings')) {
             if ($document->isAllowed('settings')) {
                 $settings = $this->decodeJson($request->get('settings'));
+
+                if(array_key_exists('prettyUrl' , $settings)){
+                    $settings['prettyUrl'] = htmlspecialchars($settings['prettyUrl']);
+                }
+
                 $document->setValues($settings);
             }
         }
     }
 
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
index f2b1d13a9995..ab612adadbf4 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/document/pages/settings.js
@@ -222,11 +222,11 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac
                                         Ext.Ajax.request({
                                             url: Routing.generate('pimcore_admin_document_page_checkprettyurl'),
                                             method: "POST",
                                             params: {
                                                 id: this.document.id,
-                                                path: el.getValue()
+                                                path: pimcore.helpers.sanitizeUrlSlug(el.getValue())
                                             },
                                             success: function (res) {
                                                 res = Ext.decode(res.responseText);
                                                 if(!res.success) {
                                                     el.getEl().addCls("pimcore_error_input");
@@ -236,10 +236,14 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings_abstrac
                                                 } else {
                                                     el.getEl().removeCls("pimcore_error_input");
                                                 }
                                             }
                                         });
+                                    }.bind(this),
+                                    "change": function (el) {
+                                        const sanitizedValue = pimcore.helpers.sanitizeUrlSlug(el.getValue());
+                                        el.setValue(sanitizedValue);
                                     }.bind(this)
                                 }
                             }
                         ]
                     }, {
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js b/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
index dcb294e6d4b2..3c38c819a6fd 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/helpers.js
@@ -16,10 +16,14 @@ pimcore.registerNS("pimcore.helpers.x");
 
 pimcore.helpers.sanitizeEmail = function (email) {
     return email.replace(/[^a-zA-Z0-9_\-@.+]/g,'');
 };
 
+pimcore.helpers.sanitizeUrlSlug = function (slug) {
+    return slug.replace(/[^a-z0-9-_+/]/gi, '');
+};
+
 pimcore.helpers.registerKeyBindings = function (bindEl, ExtJS) {
 
     if (!ExtJS) {
         ExtJS = Ext;
     }

Vulnerable code:                                                 path: el.getValue()
Fixed code: 
                if(array_key_exists('prettyUrl' , $settings)){
                    $settings['prettyUrl'] = htmlspecialchars($settings['prettyUrl']);
                }

                                                path: pimcore.helpers.sanitizeUrlSlug(el.getValue())
                                    }.bind(this),
                                    "change": function (el) {
                                        const sanitizedValue = pimcore.helpers.sanitizeUrlSlug(el.getValue());
                                        el.setValue(sanitizedValue);
pimcore.helpers.sanitizeUrlSlug = function (slug) {
    return slug.replace(/[^a-z0-9-_+/]/gi, '');
};