CVE-2023-0519: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-01-26T23:15Z
Repository: https://github.com/modoboa/modoboa
Language: JavaScript
Files changed: modoboa/admin/static/admin/js/admin.js, modoboa/core/templates/core/logs_page.html, modoboa/static/js/autocompleter.js
Commit date: 2023-01-26 10:41:15 +0100
Commit message: Avoid XSS issues while deleting account and looking at logs.

Diff: diff --git a/modoboa/admin/static/admin/js/admin.js b/modoboa/admin/static/admin/js/admin.js
index f38025b3b..c18f78299 100644
--- a/modoboa/admin/static/admin/js/admin.js
+++ b/modoboa/admin/static/admin/js/admin.js
@@ -406,11 +406,11 @@ Identities.prototype = {
         if (data.handle_mailboxes) {
             deloptions = {keepdir: gettext("Do not delete mailbox directory")};
         }
 
         $("a[name=delaccount]").confirm({
-            question: function() { return this.$element.attr('title'); },
+            question: function() { return htmlEncode(this.$element.attr('title')); },
             method: "POST",
             checkboxes: deloptions,
             success_cb: $.proxy(this.reload_listing, this)
         });
         $("a[name=delalias]").confirm({
diff --git a/modoboa/core/templates/core/logs_page.html b/modoboa/core/templates/core/logs_page.html
index 37188a46b..3ad1f9abd 100644
--- a/modoboa/core/templates/core/logs_page.html
+++ b/modoboa/core/templates/core/logs_page.html
@@ -3,8 +3,8 @@
 {% for l in logs %}
 <tr>
   <td>{{ l.date_created|date:"SHORT_DATETIME_FORMAT" }}</td>
   <td>{{ l.level|colorize_level|safe }}</td>
   <td>{{ l.logger }}</td>
-  <td>{{ l.message|tohtml|safe }}</td>
+  <td>{{ l.message }}</td>
 </tr>
 {% endfor %}
diff --git a/modoboa/static/js/autocompleter.js b/modoboa/static/js/autocompleter.js
index b28ba3b83..26f7afa43 100644
--- a/modoboa/static/js/autocompleter.js
+++ b/modoboa/static/js/autocompleter.js
@@ -54,11 +54,11 @@
 
             this.$menu.empty();
             $.each(this.choices, $.proxy(function(index, value) {
                 if (exp.test(value)) {
                     this.$menu.append(
-                        $('<li><a href="#" name="' + value + '">' + value + '</a></li>')
+                        $('<li><a href="#" name="' + htmlEncode(value) + '">' + htmlEncode(value) + '</a></li>')
                     );
                 }
             }, this));
 
             var coords = this.$element.offset();

Vulnerable code:             question: function() { return this.$element.attr('title'); },
  <td>{{ l.message|tohtml|safe }}</td>
                        $('<li><a href="#" name="' + value + '">' + value + '</a></li>')
Fixed code:             question: function() { return htmlEncode(this.$element.attr('title')); },
  <td>{{ l.message }}</td>
                        $('<li><a href="#" name="' + htmlEncode(value) + '">' + htmlEncode(value) + '</a></li>')