CVE-2021-32608: Insufficient Information (NVD-CWE-noinfo)
value: An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1. Views/Boards/Partials/_ForumPost.cshtml does not call HtmlUtils.SanitizeHtml on certain text for a forum post.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2021-05-12T15:15Z
Repository: https://github.com/smartstore/SmartStoreNET
Language: Other
Files changed: src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml
Commit date: 2021-05-10 20:10:01 +0200
Commit message: Fixed text issue in forum posts

Diff: diff --git a/src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml b/src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml
index 8cc24f3ac5..20b00c4bcd 100644
--- a/src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml
+++ b/src/Presentation/SmartStore.Web/Views/Boards/Partials/_ForumPost.cshtml
@@ -1,6 +1,8 @@
 ﻿@using SmartStore.Web.Models.Boards;
+@using SmartStore.Core.Html;
+
 @model ForumPostModel
 @Html.Raw("<a name=\"{0}\"></a>".FormatInvariant(Model.Id))
 
 <div class="block block-bordered forum-post card" id="post@(Model.Id)" data-id="@Model.Id">
     <div class="block-title card-header">
@@ -20,11 +22,11 @@
             @if (Model.IsCurrentCustomerAllowedToEditPost)
             {
                 <i class="far fa-edit"></i>
                 @Html.ActionLink(T("Forum.EditPost").Text, "PostEdit", new { id = Model.Id }, new { @class = "edit-post-link-button" })
             }
-                
+
             @if (Model.IsCurrentCustomerAllowedToDeletePost)
             {
                 <i class="fa fa-times"></i>
                 @Html.ActionLink(T("Forum.DeletePost").Text, "PostDelete", new { id = Model.Id }, new { onClick = "return confirm(" + T("Common.AreYouSure").JsText + ");", @class = "delete-post-link-button" })
             }
@@ -47,60 +49,60 @@
                 </div>
                 <div class="user-stats mt-2">
                     @if (Model.IsCustomerForumModerator)
                     {
                         <div class="status">
-							<span class="pr-1">@T("Forum.Status"):</span>
-							<span class="stat-value">@T("Forum.Moderator")</span>
+                            <span class="pr-1">@T("Forum.Status"):</span>
+                            <span class="stat-value">@T("Forum.Moderator")</span>
                         </div>
                     }
                     @if (Model.ShowCustomersPostCount)
                     {
                         <div class="totalposts">
-							<span class="pr-1">@T("Forum.TotalPosts"):</span>
-							<span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
+                            <span class="pr-1">@T("Forum.TotalPosts"):</span>
+                            <span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
                         </div>
                     }
                     @if (Model.ShowCustomersJoinDate && !Model.IsCustomerGuest)
                     {
                         <div class="joined">
                             <span class="pr-1">@T("Forum.Joined"):</span>
-							<span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
+                            <span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
                         </div>
                     }
                     @if (Model.ShowCustomersLocation && !Model.IsCustomerGuest && Model.CustomerLocation.HasValue())
                     {
                         <div class="location">
                             <span class="pr-1">@T("Forum.Location"):</span>
-							<span class="stat-value">@Model.CustomerLocation</span>
+                            <span class="stat-value">@Model.CustomerLocation</span>
                         </div>
                     }
                     @if (Model.AllowPrivateMessages && !Model.IsCustomerGuest)
-				    {
+                    {
                         <a class="btn btn btn-outline-info btn-flat button-pm mt-2" rel="nofollow" href="@Url.Action("Send", "PrivateMessages", new { id = Model.CustomerId })">
                             <i class="fa fa-user"></i>
                             <span>@T("Forum.PrivateMessages.PM")</span>
                         </a>
-				    }
+                    }
                 </div>
             </div>
         </div>
         <div class="post-content col col-sm-10">
             <div class="post-stats text-muted mb-1">
                 <span class="posttime">
                     <span class="pr-1">@T("Forum.Posted"):</span>
-				    <span class="stat-value">@Model.PostCreatedOnStr</span>
+                    <span class="stat-value">@Model.PostCreatedOnStr</span>
                 </span>
                 <span class="votes@(Model.VoteCount > 0 ? "" : " hide")" title="@T("Common.Liked")">
                     <span class="pl-1 pr-1">&middot;</span>
                     <span><i class="fa fa-thumbs-up"></i></span>
-				    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
+                    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
                 </span>
             </div>
             <div class="post-body">
                 <div class="posttext" dir="auto">
-                    @Html.Raw(Model.FormattedText)
+                    @Html.Raw(HtmlUtils.SanitizeHtml(Model.FormattedText))
                 </div>
                 @Html.Hidden("Id", Model.Id)
             </div>
 
             @if (Model.SignaturesEnabled && Model.FormattedSignature.HasValue())

Vulnerable code:                 
							<span class="pr-1">@T("Forum.Status"):</span>
							<span class="stat-value">@T("Forum.Moderator")</span>
							<span class="pr-1">@T("Forum.TotalPosts"):</span>
							<span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
							<span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
							<span class="stat-value">@Model.CustomerLocation</span>
				    {
				    }
				    <span class="stat-value">@Model.PostCreatedOnStr</span>
				    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
                    @Html.Raw(Model.FormattedText)
Fixed code: @using SmartStore.Core.Html;


                            <span class="pr-1">@T("Forum.Status"):</span>
                            <span class="stat-value">@T("Forum.Moderator")</span>
                            <span class="pr-1">@T("Forum.TotalPosts"):</span>
                            <span class="stat-value">@Model.ForumPostCount.ToString("N0")</span>
                            <span class="stat-value">@Model.CustomerJoinDate.ToNativeString("d")</span>
                            <span class="stat-value">@Model.CustomerLocation</span>
                    {
                    }
                    <span class="stat-value">@Model.PostCreatedOnStr</span>
                    <span class="vote-count stat-value">@Model.VoteCount.ToString("N0")</span>
                    @Html.Raw(HtmlUtils.SanitizeHtml(Model.FormattedText))