CVE-2023-29014: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. A reflected cross-site scripting vulnerability has been identified in Goobi viewer core prior to version 23.03 when evaluating the LOGID parameter. An attacker could trick a user into following a specially crafted link to a Goobi viewer installation, resulting in the execution of malicious script code in the user's browser. The vulnerability has been fixed in version 23.03.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-04-06T20:15Z
Repository: https://github.com/intranda/goobi-viewer-core
Language: Java
Files changed: goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java
Commit date: 2023-03-23 11:22:11 +0100
Commit message: Only allow setting logId to a value matching [\w-]+

refs #24571
Diff: diff --git a/goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java b/goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java
index 092a62620b..13619e56c3 100644
--- a/goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java
+++ b/goobi-viewer-core/src/main/java/io/goobi/viewer/managedbeans/ActiveDocumentBean.java
@@ -750,11 +750,15 @@ public class ActiveDocumentBean implements Serializable {
             this.imageToShow = imageToShow;
             if (viewManager != null) {
                 viewManager.setDropdownSelected(String.valueOf(imageToShow));
             }
             // Reset LOGID (the LOGID setter is called later by PrettyFaces, so if a value is passed, it will still be set)
-            setLogid("");
+            try {
+                setLogid("");
+            } catch (PresentationException e) {
+                //cannot be thrown here
+            }
             logger.trace("imageToShow: {}", this.imageToShow);
         }
     }
 
     /**
@@ -774,17 +778,20 @@ public class ActiveDocumentBean implements Serializable {
      * <p>
      * Setter for the field <code>logid</code>.
      * </p>
      *
      * @param logid the logid to set
+     * @throws PresentationException 
      */
-    public void setLogid(String logid) {
+    public void setLogid(String logid) throws PresentationException {
         synchronized (this) {
             if ("-".equals(logid)) {
                 this.logid = "";
-            } else {
+            } else if(StringUtils.isNotBlank(logid) && logid.matches("[\\w-]+")) {
                 this.logid = SolrTools.escapeSpecialCharacters(logid);
+            } else {
+                throw new PresentationException("The passed logId " + SolrTools.escapeSpecialCharacters(logid) + " contains illegal characters");
             }
         }
     }
 
     /**

Vulnerable code:             setLogid("");
    public void setLogid(String logid) {
            } else {
Fixed code:             try {
                setLogid("");
            } catch (PresentationException e) {
                //cannot be thrown here
            }
     * @throws PresentationException 
    public void setLogid(String logid) throws PresentationException {
            } else if(StringUtils.isNotBlank(logid) && logid.matches("[\\w-]+")) {
            } else {
                throw new PresentationException("The passed logId " + SolrTools.escapeSpecialCharacters(logid) + " contains illegal characters");