CVE-2018-8948: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP before 2.4.89, app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2018-03-23T17:29Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Events/resolved_attributes.ctp
Commit date: 2018-03-22 17:04:40 +0100
Commit message: fix: Fixed various potential XSS issues in the resolved attributes view

- potentially exposed XSS if a malicious MISP module was loaded on the instance

- as reported by Christophe Vandeplas (@cvandeplas)

Diff: diff --git a/app/View/Events/resolved_attributes.ctp b/app/View/Events/resolved_attributes.ctp
index 0243dc5a0b..809ea83003 100644
--- a/app/View/Events/resolved_attributes.ctp
+++ b/app/View/Events/resolved_attributes.ctp
@@ -141,12 +141,12 @@
 				<div id = "<?php echo 'Attribute' . $k . 'TypeStatic'; ?>" <?php echo $divVisibility; ?> ><?php echo h($item['default_type']); ?></div>
 				<select id = "<?php echo 'Attribute' . $k . 'Type'; ?>" class='typeToggle' style='padding:0px;height:20px;margin-bottom:0px;<?php echo $selectVisibility; ?>'>
 					<?php
 						if (!empty($item['types'])) {
 							foreach ($item['types'] as $type) {
-								echo '<option value="' . $type . '" ';
-								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . $type . '</option>';
+								echo '<option value="' . h($type) . '" ';
+								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . h($type) . '</option>';
 							}
 						}
 					?>
 				</select>
 			</td>
@@ -165,21 +165,21 @@
 				</select>
 				<div style="display:none;">
 					<select id = "<?php echo 'Attribute' . $k . 'SharingGroupId'; ?>" class='sgToggle' style='padding:0px;height:20px;margin-top:3px;margin-bottom:0px;'>
 						<?php
 							foreach ($sgs as $sgKey => $sgValue) {
-								echo '<option value="' . $sgKey . '">' . $sgValue . '</option>';
+								echo '<option value="' . h($sgKey) . '">' . h($sgValue) . '</option>';
 							}
 						?>
 					</select>
 				</div>
 			</td>
 			<td class="short">
-				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . $item['comment'] . '"'?>/>
+				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . h($item['comment']) . '"'?>/>
 			</td>
 			<td class="short">
-				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . htmlspecialchars(implode(",",$item['tags'])) . '"'?>/>
+				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . h(implode(",",$item['tags'])) . '"'?>/>
 			</td>
 			<td class="action short">
 				<span class="icon-remove pointer" title="<?php echo __('Remove resolved attribute');?>" role="button" tabindex="0" aria-label="<?php echo __('Remove resolved attribute');?>" onClick="freetextRemoveRow('<?php echo $k; ?>', '<?php echo $event['Event']['id']; ?>');"></span>
 			</td>
 		</tr>
@@ -204,11 +204,11 @@
 			?>
 				<select id="changeFrom" style="margin-left:50px;margin-top:10px;">
 					<?php
 						foreach (array_keys($optionsRearranged) as $fromElement):
 					?>
-							<option><?php echo $fromElement; ?></option>
+							<option><?php echo h($fromElement); ?></option>
 					<?php
 						endforeach;
 					?>
 				</select>
 				<span class="icon-arrow-right"></span>

Vulnerable code: 								echo '<option value="' . $type . '" ';
								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . $type . '</option>';
								echo '<option value="' . $sgKey . '">' . $sgValue . '</option>';
				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . $item['comment'] . '"'?>/>
				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . htmlspecialchars(implode(",",$item['tags'])) . '"'?>/>
							<option><?php echo $fromElement; ?></option>
Fixed code: 								echo '<option value="' . h($type) . '" ';
								echo ($type == $item['default_type'] ? 'selected="selected"' : '') . '>' . h($type) . '</option>';
								echo '<option value="' . h($sgKey) . '">' . h($sgValue) . '</option>';
				<input type="text" class="freetextCommentField" id="<?php echo 'Attribute' . $k . 'Comment'; ?>" style="padding:0px;height:20px;margin-bottom:0px;" placeholder="<?php echo h($importComment); ?>" <?php if (isset($item['comment']) && $item['comment'] !== false) echo 'value="' . h($item['comment']) . '"'?>/>
				<input type="text" class="freetextTagField" id="<?php echo 'Attribute' . $k . 'Tags'; ?>" style="padding:0px;height:20px;margin-bottom:0px;"<?php if (isset($item['tags']) && $item['tags'] !== false) echo 'value="' . h(implode(",",$item['tags'])) . '"'?>/>
							<option><?php echo h($fromElement); ?></option>