CVE-2020-28947: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP 2.4.134, XSS exists in the template element index view because the id parameter is mishandled.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-11-19T18:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/TemplateElementsController.php, app/Model/Template.php, app/View/TemplateElements/ajax/ajaxIndex.ctp
Commit date: 2020-11-18 06:29:55 +0100
Commit message: fix: [security] XSS in the template element index view
- As reported by Rubin Azad

Diff: diff --git a/app/Controller/TemplateElementsController.php b/app/Controller/TemplateElementsController.php
index 2f2bab90307..623499b08f2 100644
--- a/app/Controller/TemplateElementsController.php
+++ b/app/Controller/TemplateElementsController.php
@@ -13,15 +13,17 @@ class TemplateElementsController extends AppController
             )
     );
 
     public function index($id)
     {
-
+        if (!is_numeric($id)) {
+            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
+        }
         //check permissions
         $template = $this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), false);
         if (!$this->_isSiteAdmin() && !$template) {
-            throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.');
+            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
         }
 
         $templateElements = $this->TemplateElement->find('all', array(
             'conditions' => array(
                 'template_id' => $id,
diff --git a/app/Model/Template.php b/app/Model/Template.php
index 7de4495415e..4bc51696096 100644
--- a/app/Model/Template.php
+++ b/app/Model/Template.php
@@ -50,11 +50,11 @@ class Template extends AppModel
         // if not found return false
         if (empty($template)) {
             return false;
         }
 
-        //if the user is a site admin, return the template withoug question
+        //if the user is a site admin, return the template without question
         if ($user['Role']['perm_site_admin']) {
             return $template;
         }
 
         if ($write) {
diff --git a/app/View/TemplateElements/ajax/ajaxIndex.ctp b/app/View/TemplateElements/ajax/ajaxIndex.ctp
index c9e0a614933..a6eb083c5fd 100644
--- a/app/View/TemplateElements/ajax/ajaxIndex.ctp
+++ b/app/View/TemplateElements/ajax/ajaxIndex.ctp
@@ -6,11 +6,11 @@
                     echo $this->element('templateElements/templateRow' . ucfirst($element['TemplateElement']['element_definition']), array('element' => $element, 'element_id' => $element['TemplateElement']['id']));
                 endforeach;
             ?>
     </ul>
     <?php if ($mayModify): ?>
-    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo $id; ?>);">+</div>
+    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo h($id); ?>);">+</div>
     <?php endif; ?>
 </div>
 <script type="text/javascript">
 $(function() {
     //Return a helper with preserved width of cells

Vulnerable code: 
            throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.');
        //if the user is a site admin, return the template withoug question
    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo $id; ?>);">+</div>
Fixed code:         if (!is_numeric($id)) {
            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
        }
            throw new MethodNotAllowedException(__('No template with the provided ID exists, or you are not authorised to see it.'));
        //if the user is a site admin, return the template without question
    <div id="AddTemplateElementDiv" role="button" tabindex="0" aria-label="<?php echo __('Add a new template element');?>" title="<?php echo __('Add a new template element');?>" class="addTemplateElement useCursorPointer" onClick="templateAddElementClicked(<?php echo h($id); ?>);">+</div>