CVE-2021-4081: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-12-10T11:15Z
Repository: https://github.com/pimcore/pimcore
Language: JavaScript
Files changed: bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js, bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js, bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
Commit date: 2021-12-09 11:16:46 +0100
Commit message: [Admin UI] Escape query on Search Window

Diff: diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js
index fbf9da00019..21d988457db 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/asset.js
@@ -267,20 +267,21 @@ pimcore.element.selector.asset = Class.create(pimcore.element.selector.abstract,
     getGrid: function () {
         return this.resultPanel;
     },
 
     search: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
-        var proxy = this.store.getProxy();
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "asset");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
 
         if (this.parent.config && this.parent.config.context) {
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
         this.pagingtoolbar.moveFirst();
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     }
 });
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js
index e4679631ac6..2a5b7659d13 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/document.js
@@ -241,20 +241,21 @@ pimcore.element.selector.document = Class.create(pimcore.element.selector.abstra
     getGrid: function () {
         return this.resultPanel;
     },
 
     search: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
-        var proxy = this.store.getProxy();
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "document");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
 
         if (this.parent.config && this.parent.config.context) {
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
         this.pagingtoolbar.moveFirst();
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     }
 });
diff --git a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
index 040deedc5df..b50e65bdd2a 100644
--- a/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
+++ b/bundles/AdminBundle/Resources/public/js/pimcore/element/selector/object.js
@@ -572,16 +572,16 @@ pimcore.element.selector.object = Class.create(pimcore.element.selector.abstract
     getGrid: function () {
         return this.gridPanel;
     },
 
     applyExtraParamsToStore: function () {
-        var formValues = this.formPanel.getForm().getFieldValues();
-
-        var proxy = this.store.getProxy();
+        let formValues = this.formPanel.getForm().getFieldValues();
 
+        let proxy = this.store.getProxy();
+        let query = Ext.util.Format.htmlEncode(formValues.query);
         proxy.setExtraParam("type", "object");
-        proxy.setExtraParam("query", formValues.query);
+        proxy.setExtraParam("query", query);
         proxy.setExtraParam("subtype", formValues.subtype);
         proxy.setExtraParam("class", formValues.class);
 
         if (this.gridLanguage) {
             proxy.setExtraParam("language", this.gridLanguage);
@@ -589,11 +589,11 @@ pimcore.element.selector.object = Class.create(pimcore.element.selector.abstract
 
         if (this.parent.config && this.parent.config.context) {
             proxy.setExtraParam("context", Ext.encode(this.parent.config.context));
         }
 
-        this.updateTabTitle(formValues.query);
+        this.updateTabTitle(query);
     },
 
     search: function () {
         this.applyExtraParamsToStore();
         this.pagingtoolbar.moveFirst();

Vulnerable code:         var formValues = this.formPanel.getForm().getFieldValues();
        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);
        var formValues = this.formPanel.getForm().getFieldValues();
        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);
        var formValues = this.formPanel.getForm().getFieldValues();

        var proxy = this.store.getProxy();
        proxy.setExtraParam("query", formValues.query);
        this.updateTabTitle(formValues.query);
Fixed code:         let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);
        let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);
        let formValues = this.formPanel.getForm().getFieldValues();
        let proxy = this.store.getProxy();
        let query = Ext.util.Format.htmlEncode(formValues.query);
        proxy.setExtraParam("query", query);
        this.updateTabTitle(query);