CVE-2020-11062: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In GLPI after 0.68.1 and before 9.4.6, multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-05-12T20:15Z
Repository: https://github.com/glpi-project/glpi
Language: PHP
Files changed: ajax/autocompletion.php, ajax/getDropdownConnect.php, ajax/getDropdownFindNum.php, ajax/getDropdownNetpoint.php, ajax/getDropdownNumber.php, ajax/getDropdownUsers.php, ajax/getDropdownValue.php
Commit date: 2020-03-06 09:56:08 +0100
Commit message: Use correct content-type for autocompletion url

Diff: diff --git a/ajax/autocompletion.php b/ajax/autocompletion.php
index bc0108d66f..dc6843ade1 100644
--- a/ajax/autocompletion.php
+++ b/ajax/autocompletion.php
@@ -33,11 +33,11 @@
 // Include plugin if it is a plugin table
 if (!strstr($_GET['itemtype'], "Plugin")) {
    $AJAX_INCLUDE = 1;
 }
 include ('../inc/includes.php');
-header("Content-Type: text/html; charset=UTF-8");
+header("Content-Type: application/json; charset=UTF-8");
 Html::header_nocache();
 
 Session::checkLoginUser();
 
 // Security
diff --git a/ajax/getDropdownConnect.php b/ajax/getDropdownConnect.php
index ce4662f7b4..d0a2113fce 100644
--- a/ajax/getDropdownConnect.php
+++ b/ajax/getDropdownConnect.php
@@ -34,11 +34,11 @@
  * @since 0.85
  */
 
 if (strpos($_SERVER['PHP_SELF'], "getDropdownConnect.php")) {
    include ('../inc/includes.php');
-   header("Content-Type: text/html; charset=UTF-8");
+   header("Content-Type: application/json; charset=UTF-8");
    Html::header_nocache();
 } else if (!defined('GLPI_ROOT')) {
    die("Sorry. You can't access this file directly");
 }
 
diff --git a/ajax/getDropdownFindNum.php b/ajax/getDropdownFindNum.php
index f3b1d0814e..cf3612f942 100644
--- a/ajax/getDropdownFindNum.php
+++ b/ajax/getDropdownFindNum.php
@@ -35,10 +35,10 @@
  * @since 0.85
  */
 
 include ('../inc/includes.php');
 
-header("Content-Type: text/html; charset=UTF-8");
+header("Content-Type: application/json; charset=UTF-8");
 Html::header_nocache();
 
 Session::checkLoginUser();
 echo Dropdown::getDropdownFindNum($_POST);
diff --git a/ajax/getDropdownNetpoint.php b/ajax/getDropdownNetpoint.php
index 8f2e1edbc6..50a54bfb54 100644
--- a/ajax/getDropdownNetpoint.php
+++ b/ajax/getDropdownNetpoint.php
@@ -36,11 +36,11 @@
 
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "getDropdownNetpoint.php")) {
    $AJAX_INCLUDE = 1;
    include ('../inc/includes.php');
-   header("Content-Type: text/html; charset=UTF-8");
+   header("Content-Type: application/json; charset=UTF-8");
    Html::header_nocache();
 } else if (!defined('GLPI_ROOT')) {
    die("Sorry. You can't access this file directly");
 }
 
diff --git a/ajax/getDropdownNumber.php b/ajax/getDropdownNumber.php
index 3674eb297b..7470d1a597 100644
--- a/ajax/getDropdownNumber.php
+++ b/ajax/getDropdownNumber.php
@@ -35,11 +35,11 @@
  */
 
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "getDropdownNumber.php")) {
    include ('../inc/includes.php');
-   header("Content-Type: text/html; charset=UTF-8");
+   header("Content-Type: application/json; charset=UTF-8");
    Html::header_nocache();
 } else if (!defined('GLPI_ROOT')) {
    die("Sorry. You can't access this file directly");
 }
 
diff --git a/ajax/getDropdownUsers.php b/ajax/getDropdownUsers.php
index 9947877ebe..a3cee00675 100644
--- a/ajax/getDropdownUsers.php
+++ b/ajax/getDropdownUsers.php
@@ -36,11 +36,11 @@
 
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "getDropdownUsers.php")) {
    $AJAX_INCLUDE = 1;
    include ('../inc/includes.php');
-   header("Content-Type: text/html; charset=UTF-8");
+   header("Content-Type: application/json; charset=UTF-8");
    Html::header_nocache();
 } else if (!defined('GLPI_ROOT')) {
    die("Sorry. You can't access this file directly");
 }
 
diff --git a/ajax/getDropdownValue.php b/ajax/getDropdownValue.php
index 17bfd648ff..09b3943207 100644
--- a/ajax/getDropdownValue.php
+++ b/ajax/getDropdownValue.php
@@ -35,11 +35,11 @@
  */
 
 // Direct access to file
 if (strpos($_SERVER['PHP_SELF'], "getDropdownValue.php")) {
    include ('../inc/includes.php');
-   header("Content-Type: text/html; charset=UTF-8");
+   header("Content-Type: application/json; charset=UTF-8");
    Html::header_nocache();
 } else if (!defined('GLPI_ROOT')) {
    die("Sorry. You can't access this file directly");
 }
 

Vulnerable code: header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
   header("Content-Type: text/html; charset=UTF-8");
Fixed code: header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");
   header("Content-Type: application/json; charset=UTF-8");