CVE-2023-0566: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.


CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-01-29T22:15Z
Repository: https://github.com/froxlor/froxlor
Language: PHP
Files changed: lib/Froxlor/Api/Commands/Cronjobs.php, lng/de.lng.php, lng/en.lng.php
Commit date: 2023-01-28 13:06:44 +0100
Commit message: verify cronjob interval is one of the fixed available values

Signed-off-by: Michael Kaufmann <d00p@froxlor.org>

Diff: diff --git a/lib/Froxlor/Api/Commands/Cronjobs.php b/lib/Froxlor/Api/Commands/Cronjobs.php
index 2584aef57b..d967876330 100644
--- a/lib/Froxlor/Api/Commands/Cronjobs.php
+++ b/lib/Froxlor/Api/Commands/Cronjobs.php
@@ -30,19 +30,28 @@ use Froxlor\Api\ApiCommand;
 use Froxlor\Api\ResourceEntity;
 use Froxlor\Cron\TaskId;
 use Froxlor\Database\Database;
 use Froxlor\FroxlorLogger;
 use Froxlor\System\Cronjob;
+use Froxlor\UI\Response;
 use Froxlor\Validate\Validate;
 use PDO;
 
 /**
  * @since 0.10.0
  */
 class Cronjobs extends ApiCommand implements ResourceEntity
 {
 
+	private array $allowed_intervals = [
+		'MINUTE',
+		'HOUR',
+		'DAY',
+		'WEEK',
+		'MONTH'
+	];
+
 	/**
 	 * You cannot add new cronjobs yet.
 	 */
 	public function add()
 	{
@@ -116,10 +125,14 @@ class Cronjobs extends ApiCommand implements ResourceEntity
 				$isactive = 0;
 			}
 			$interval_value = Validate::validate($interval_value, 'interval_value', '/^([0-9]+)$/Di', 'stringisempty', [], true);
 			$interval_interval = Validate::validate($interval_interval, 'interval_interval', '', '', [], true);
 
+			if (!in_array(strtoupper($interval_interval), $this->allowed_intervals)) {
+				Response::standardError('invalidcronjobintervalvalue', implode(", ", $this->allowed_intervals), true);
+			}
+
 			// put together interval value
 			$interval = $interval_value . ' ' . strtoupper($interval_interval);
 
 			$upd_stmt = Database::prepare("
 				UPDATE `" . TABLE_PANEL_CRONRUNS . "`
diff --git a/lng/de.lng.php b/lng/de.lng.php
index 49c2055040..f5ebea66b9 100644
--- a/lng/de.lng.php
+++ b/lng/de.lng.php
@@ -918,10 +918,11 @@ return [
 		'invaliddnsforletsencrypt' => 'Die DNS-Einträge der Domain enhalten keine der gewählten IP Adressen. Let\'s Encrypt Zertifikats-Erstellung ist nicht möglich.',
 		'notallowedphpconfigused' => 'Nutzung einer PHP-Konfiguration welche nicht dem Kunden zugeordnet ist',
 		'pathmustberelative' => 'Der Benutzer hat nicht die benötigten Berechtigungen, um Pfade außerhalb des Kunden-Heimatverzeichnisses anzugeben. Bitte einen relativen Pfad angeben (kein führendes /).',
 		'mysqlserverstillhasdbs' => 'Datenbank-Server kann für den Kunden nicht entfernt werden, da sich dort noch Datenbanken befinden.',
 		'domaincannotbeedited' => 'Keine Berechtigung, um die Domain %s zu bearbeiten',
+		'invalidcronjobintervalvalue' => 'Cronjob Intervall muss einer der folgenden Werte sein: %s',
 	],
 	'extras' => [
 		'description' => 'Hier können Sie zusätzliche Extras einrichten, wie zum Beispiel einen Verzeichnisschutz.<br />Die Änderungen sind erst nach einer kurzen Zeit wirksam.',
 		'directoryprotection_add' => 'Verzeichnisschutz anlegen',
 		'view_directory' => 'Verzeichnis anzeigen',
diff --git a/lng/en.lng.php b/lng/en.lng.php
index 815144698e..69cdf753f4 100644
--- a/lng/en.lng.php
+++ b/lng/en.lng.php
@@ -987,10 +987,11 @@ return [
 		'invaliddnsforletsencrypt' => 'The domains DNS does not include any of the chosen IP addresses. Let\'s Encrypt certificate generation not possible.',
 		'notallowedphpconfigused' => 'Trying to use php-config which is not assigned to customer',
 		'pathmustberelative' => 'The user does not have the permission to specify directories outside the customers home-directory. Please specify a relative path (no leading /).',
 		'mysqlserverstillhasdbs' => 'Cannot remove database server from customers allow-list as there are still databases on it.',
 		'domaincannotbeedited' => 'You are not permitted to edit the domain %s',
+		'invalidcronjobintervalvalue' => 'Cronjob interval must be one of: %s',
 	],
 	'extras' => [
 		'description' => 'Here you can add some extras, for example directory protection.<br />The system will need some time to apply the new settings after every change.',
 		'directoryprotection_add' => 'Add directory protection',
 		'view_directory' => 'Display directory content',

Fixed code: use Froxlor\UI\Response;
	private array $allowed_intervals = [
		'MINUTE',
		'HOUR',
		'DAY',
		'WEEK',
		'MONTH'
	];

			if (!in_array(strtoupper($interval_interval), $this->allowed_intervals)) {
				Response::standardError('invalidcronjobintervalvalue', implode(", ", $this->allowed_intervals), true);
			}

		'invalidcronjobintervalvalue' => 'Cronjob Intervall muss einer der folgenden Werte sein: %s',
		'invalidcronjobintervalvalue' => 'Cronjob interval must be one of: %s',