CVE-2017-7215: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross site scripting in some view elements in the index filter tool in app/webroot/js/misp2.4.68.js and the organisation landing page in app/View/Organisations/ajax/landingpage.ctp of MISP before 2.4.69 allows remote attackers to inject arbitrary web script or HTML.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-03-21T19:59Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/misp2.4.68.js
Commit date: 2017-03-10 09:22:16 +0100
Commit message: fix: Tightened sanitisation in some view elements
- on the index filter tool
- organisation landing page

as reported by Tien Phan and David Maciejak of Fortinet's FortiGuard Labs

Diff: diff --git a/app/webroot/js/misp2.4.68.js b/app/webroot/js/misp2.4.68.js
index 211ad3017..c815dcd58 100644
--- a/app/webroot/js/misp2.4.68.js
+++ b/app/webroot/js/misp2.4.68.js
@@ -1324,14 +1324,14 @@ function indexEvaluateFiltering() {
 		} else {
 			$('#value_hasproposal').html("");
 		}
 		if (filtering.date.from != null || filtering.date.from != null) {
 			var text = "";
-			if (filtering.date.from != "") text = "From: " + filtering.date.from;
+			if (filtering.date.from != "") text = "From: " + $('<span>').text(filtering.date.from).html();
 			if (filtering.date.until != "") {
 				if (text != "") text += " ";
-				text += "Until: " + filtering.date.until;
+				text += "Until: " + $('<span>').text(filtering.date.until).html();
 			}
 		}
 		$('#value_date').html(text);
 		for (var i = 0; i < simpleFilters.length; i++) {
 			indexEvaluateSimpleFiltering(simpleFilters[i]);
@@ -1341,22 +1341,22 @@ function indexEvaluateFiltering() {
 		for (var i = 0; i < differentFilters.length; i++) {
 			if (filtering[differentFilters[i]] != "") {
 				var text = "";
 				if (filtering[differentFilters[i]] == 1) text = "Yes";
 				else if (filtering[differentFilters[i]] == 0) text = "No";
-				$('#value_' + differentFilters[i]).html(text);
+				$('#value_' + differentFilters[i]).text(text);
 			} else {
-				$('#value_' + differentFilters[i]).html("");
+				$('#value_' + differentFilters[i]).text("");
 			}
 		}
 		for (var i = 0; i < simpleFilters.length; i++) {
 			indexEvaluateSimpleFiltering(simpleFilters[i]);
 		}
 	}
 	indexSetTableVisibility();
 	indexSetRowVisibility();
-	$('#generatedURLContent').html(indexCreateFilters());
+	$('#generatedURLContent').text(indexCreateFilters());
 }
 
 function quickFilter(passedArgs, url) {
 	passedArgs["searchall"] = $('#quickFilterField').val().trim();
 	for (var key in passedArgs) {
@@ -1474,15 +1474,15 @@ function indexEvaluateSimpleFiltering(field) {
 	}
 	if (filtering[field].OR.length !=0) {
 		for (var i = 0; i < filtering[field].OR.length; i++) {
 			if (i > 0) text += '<span class="green bold"> OR </span>';
 			if (typedFields.indexOf(field) == -1) {
-				text += filtering[field].OR[i];
+				text += $('<span>').text(filtering[field].OR[i]).html();
 			} else {
 				for (var j = 0; j < typeArray[field].length; j++) {
 					if (typeArray[field][j].id == filtering[field].OR[i]) {
-						text += typeArray[field][j].value;
+						text += $('<span>').text(typeArray[field][j].value).html();
 					}
 				}
 			}
 		}
 	}
@@ -1491,15 +1491,15 @@ function indexEvaluateSimpleFiltering(field) {
 			if (i == 0) {
 				if (text != "") text += '<span class="red bold"> AND NOT </span>';
 				else text += '<span class="red bold">NOT </span>';
 			} else text += '<span class="red bold"> AND NOT </span>';
 			if (typedFields.indexOf(field) == -1) {
-				text += filtering[field].NOT[i];
+				text += $('<span>').text(filtering[field].NOT[i]).html();
 			} else {
 				for (var j = 0; j < typeArray[field].length; j++) {
 					if (typeArray[field][j].id == filtering[field].NOT[i]) {
-						text += typeArray[field][j].value;
+						text += $('<span>').text(typeArray[field][j].value).html();
 					}
 				}
 			}
 		}
 	}

Vulnerable code: 			if (filtering.date.from != "") text = "From: " + filtering.date.from;
				text += "Until: " + filtering.date.until;
				$('#value_' + differentFilters[i]).html(text);
				$('#value_' + differentFilters[i]).html("");
	$('#generatedURLContent').html(indexCreateFilters());
				text += filtering[field].OR[i];
						text += typeArray[field][j].value;
				text += filtering[field].NOT[i];
						text += typeArray[field][j].value;
Fixed code: 			if (filtering.date.from != "") text = "From: " + $('<span>').text(filtering.date.from).html();
				text += "Until: " + $('<span>').text(filtering.date.until).html();
				$('#value_' + differentFilters[i]).text(text);
				$('#value_' + differentFilters[i]).text("");
	$('#generatedURLContent').text(indexCreateFilters());
				text += $('<span>').text(filtering[field].OR[i]).html();
						text += $('<span>').text(typeArray[field][j].value).html();
				text += $('<span>').text(filtering[field].NOT[i]).html();
						text += $('<span>').text(typeArray[field][j].value).html();