CVE-2022-27246: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-03-18T18:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Config/config.default.php, app/Controller/OrganisationsController.php, app/Model/Server.php, app/View/Organisations/admin_add.ctp
Commit date: 2022-03-17 14:36:07 +0100
Commit message: new: add setting for allowing svg org logos

Diff: diff --git a/app/Config/config.default.php b/app/Config/config.default.php
index dea2f9d8a799..eee991773a7d 100644
--- a/app/Config/config.default.php
+++ b/app/Config/config.default.php
@@ -15,10 +15,11 @@ $config = array(
         'allow_self_registration'           => false,
         'rest_client_enable_arbitrary_urls' => false,
         'user_monitoring_enabled'           => false,
         'authkey_keep_session'              => false,
         'disable_local_feed_access'         => false,
+        'enable_svg_logos'                  => false,
         //'auth'                            => array('CertAuth.Certificate'), // additional authentication methods
         //'auth'                            => array('ShibbAuth.ApacheShibb'),
         //'auth'                            => array('AadAuth.AadAuthenticate'),
         //'auth'                            => array('LinOTPAuth.LinOTP'),
     ),
diff --git a/app/Controller/OrganisationsController.php b/app/Controller/OrganisationsController.php
index 78ca7dc79d59..7d9f6345d721 100644
--- a/app/Controller/OrganisationsController.php
+++ b/app/Controller/OrganisationsController.php
@@ -481,10 +481,16 @@ class OrganisationsController extends AppController
 
         $logo = $this->request->data['Organisation']['logo'];
         if ($logo['size'] > 0 && $logo['error'] == 0) {
             $extension = pathinfo($logo['name'], PATHINFO_EXTENSION);
             $filename = $orgId . '.' . ($extension === 'svg' ? 'svg' : 'png');
+
+            if ($extension === 'svg' && !Configure::read('Security.enable_svg_logos')) {
+                $this->Flash->error(__('Invalid file extension, SVG images are not allowed.'));
+                return false;
+            }
+
             if (!empty($logo['tmp_name']) && is_uploaded_file($logo['tmp_name'])) {
                 return move_uploaded_file($logo['tmp_name'], APP . 'webroot/img/orgs/' . $filename);
             }
         }
 
diff --git a/app/Model/Server.php b/app/Model/Server.php
index 0c05bdf51c05..9b987bb6ac24 100644
--- a/app/Model/Server.php
+++ b/app/Model/Server.php
@@ -6134,10 +6134,18 @@ class Server extends AppModel
                         'tlsv1_1' => 'TLSv1.1',
                         'tlsv1_2' => 'TLSv1.2',
                         'tlsv1_3' => 'TLSv1.3',
                     ],
                 ],
+                'enable_svg_logos' => [
+                    'level' => self::SETTING_OPTIONAL,
+                    'description' => __('When enabled, orgnisation logos in svg format are allowed.'),
+                    'value' => false,
+                    'test' => 'testBool',
+                    'type' => 'boolean',
+                    'null' => true
+                ]
             ),
             'SecureAuth' => array(
                 'branch' => 1,
                 'amount' => array(
                     'level' => 0,
diff --git a/app/View/Organisations/admin_add.ctp b/app/View/Organisations/admin_add.ctp
index 97d51fc43da1..202745e86953 100644
--- a/app/View/Organisations/admin_add.ctp
+++ b/app/View/Organisations/admin_add.ctp
@@ -48,11 +48,11 @@ echo $this->element('genericElements/Form/genericForm', [
             ],
             [
                 'type' => 'file',
                 'field' => 'logo',
                 'error' => array('escape' => false),
-                'label' => __('Logo (48×48 PNG or SVG)'),
+                'label' => __('Logo (48×48 %s)', Configure::read('Security.enable_svg_logos')? 'PNG or SVG' : 'PNG'),
             ],
             [
                 'field' => 'nationality',
                 'options' => $countries,
                 'class' => 'span4',

Vulnerable code:                 'label' => __('Logo (48×48 PNG or SVG)'),
Fixed code:         'enable_svg_logos'                  => false,

            if ($extension === 'svg' && !Configure::read('Security.enable_svg_logos')) {
                $this->Flash->error(__('Invalid file extension, SVG images are not allowed.'));
                return false;
            }

                'enable_svg_logos' => [
                    'level' => self::SETTING_OPTIONAL,
                    'description' => __('When enabled, orgnisation logos in svg format are allowed.'),
                    'value' => false,
                    'test' => 'testBool',
                    'type' => 'boolean',
                    'null' => true
                ]
                'label' => __('Logo (48×48 %s)', Configure::read('Security.enable_svg_logos')? 'PNG or SVG' : 'PNG'),