CVE-2019-11812: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-05-08T13:29Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/View/Helper/CommandHelper.php
Commit date: 2019-05-07 08:58:36 +0200
Commit message: fix: [security] Fix persistent xss via discussion links via javascript:// links

- low impact as it requires user interaction to trigger

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)

Diff: diff --git a/app/View/Helper/CommandHelper.php b/app/View/Helper/CommandHelper.php
index 8cc94c687f..49c8287740 100644
--- a/app/View/Helper/CommandHelper.php
+++ b/app/View/Helper/CommandHelper.php
@@ -66,14 +66,18 @@ App::uses('AppHelper', 'View/Helper');
                     } else {
                         if (!is_numeric($data) && ($trigger == 'event' || $trigger == 'thread')) {
                             $replacement = '%MALFORMED URL%';
                         } else {
                             if (filter_var(str_replace('$1', $data, $this->__replacement[$trigger]['url']), FILTER_VALIDATE_URL)) {
-                                $replacement = $this->Html->link(
-                                    str_replace('$1', $data, $this->__replacement[$trigger]['text']),
-                                    str_replace('$1', $data, $this->__replacement[$trigger]['url'])
-                                );
+                                if (substr($data, 0, 7) === 'http://' || substr($data, 0, 8) === 'https://') {
+                                    $replacement = $this->Html->link(
+                                        str_replace('$1', $data, $this->__replacement[$trigger]['text']),
+                                        str_replace('$1', $data, $this->__replacement[$trigger]['url'])
+                                    );
+                                } else {
+                                    $replacement = '%MALFORMED URL%';
+                                }
                             } else {
                                 $replacement = '%MALFORMED URL%';
                             }
                         }
                     }

Vulnerable code:                                 $replacement = $this->Html->link(
                                    str_replace('$1', $data, $this->__replacement[$trigger]['text']),
                                    str_replace('$1', $data, $this->__replacement[$trigger]['url'])
                                );
Fixed code:                                 if (substr($data, 0, 7) === 'http://' || substr($data, 0, 8) === 'https://') {
                                    $replacement = $this->Html->link(
                                        str_replace('$1', $data, $this->__replacement[$trigger]['text']),
                                        str_replace('$1', $data, $this->__replacement[$trigger]['url'])
                                    );
                                } else {
                                    $replacement = '%MALFORMED URL%';
                                }