CVE-2022-27244: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-03-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Users/admin_add.ctp, app/View/Users/admin_edit.ctp
Commit date: 2022-03-17 14:10:09 +0100
Commit message: fix: [security] stored XSS in the user add/edit forms

- a malicious site administrator could store an XSS payload in the custom auth name which would be executed each time the administrator modifies a user

- as reported by Ianis BERNARD - NATO Cyber Security Centre

Diff: diff --git a/app/View/Users/admin_add.ctp b/app/View/Users/admin_add.ctp
index 97390a92aa2..504057f57a7 100644
--- a/app/View/Users/admin_add.ctp
+++ b/app/View/Users/admin_add.ctp
@@ -11,11 +11,11 @@
         if (Configure::read('Plugin.CustomAuth_enable')) {
             if (Configure::read('Plugin.CustomAuth_required')) {
                 $password = false;
             } else {
                 $userType = Configure::read('Plugin.CustomAuth_name') ? Configure::read('Plugin.CustomAuth_name') : 'External authentication';
-                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));
+                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));
             }
             echo sprintf(
                 '<div class="clear"></div><div %s>%s</div>',
                 (
                     (
diff --git a/app/View/Users/admin_edit.ctp b/app/View/Users/admin_edit.ctp
index 934b53ef6b2..d2a91ad0d47 100644
--- a/app/View/Users/admin_edit.ctp
+++ b/app/View/Users/admin_edit.ctp
@@ -14,11 +14,11 @@
         if (Configure::read('Plugin.CustomAuth_enable')) {
             if (Configure::read('Plugin.CustomAuth_required')) {
                 $password = false;
             } else {
                 $userType = Configure::read('Plugin.CustomAuth_name') ? Configure::read('Plugin.CustomAuth_name') : 'External authentication';
-                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));
+                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));
             }
             echo sprintf(
                 '<div class="clear"></div><div %s>%s</div>',
                 (
                     (

Vulnerable code:                 echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => $userType . ' user'));
Fixed code:                 echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));
                echo $this->Form->input('external_auth_required', array('type' => 'checkbox', 'label' => h($userType) . ' user'));