CVE-2022-0506: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-02-08T09:15Z
Repository: https://github.com/microweber/microweber
Language: PHP
Files changed: src/MicroweberPackages/User/routes/api.php, src/MicroweberPackages/User/routes/web.php
Commit date: 2022-02-02 13:42:40 +0200
Commit message: add css middleware

Diff: diff --git a/src/MicroweberPackages/User/routes/api.php b/src/MicroweberPackages/User/routes/api.php
index db0002bfab5..a2d5cc4c13a 100644
--- a/src/MicroweberPackages/User/routes/api.php
+++ b/src/MicroweberPackages/User/routes/api.php
@@ -84,11 +84,19 @@ Route::post('api/delete_user', function (Request $request) {
     }
     $input = Input::all();
     return delete_user($input);
 })->middleware(['api']);
 
-Route::name('api.user.')->prefix('api/user')->middleware(['public.api'])->namespace('\MicroweberPackages\User\Http\Controllers')->group(function () {
+Route::name('api.user.')
+    ->prefix('api/user')
+    ->middleware([
+        'public.api',
+      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
+        \MicroweberPackages\App\Http\Middleware\XSS::class
+    ])
+    ->namespace('\MicroweberPackages\User\Http\Controllers')
+    ->group(function () {
 
     Route::post('login', 'UserLoginController@login')->name('login')->middleware(['allowed_ips','throttle:60,1']);
     Route::any('logout', 'UserLoginController@logout')->name('logout');
     Route::post('register', 'UserRegisterController@register')->name('register')->middleware(['allowed_ips']);
 
@@ -99,10 +107,14 @@ Route::name('api.user.')->prefix('api/user')->middleware(['public.api'])->namesp
 
 });
 
 Route::name('api.')
     ->prefix('api')
-    ->middleware(['api'])
+    ->middleware([
+        'api',
+      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
+        \MicroweberPackages\App\Http\Middleware\XSS::class
+    ])
     ->namespace('\MicroweberPackages\User\Http\Controllers\Api')
     ->group(function () {
         Route::apiResource('user', 'UserApiController');
     });
diff --git a/src/MicroweberPackages/User/routes/web.php b/src/MicroweberPackages/User/routes/web.php
index 05d7c575038..c70d9b54c57 100644
--- a/src/MicroweberPackages/User/routes/web.php
+++ b/src/MicroweberPackages/User/routes/web.php
@@ -15,11 +15,15 @@ use Illuminate\Support\Facades\Route;
 // Route::get('login', '\MicroweberPackages\User\Http\Controllers\UserLoginController@loginForm')->name('login');
 
 
 Route::name('admin.')
     ->prefix('admin')
-    ->middleware(['admin'])
+    ->middleware([
+        'admin',
+       // \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
+        \MicroweberPackages\App\Http\Middleware\XSS::class
+    ])
     ->namespace('\MicroweberPackages\User\Http\Controllers\Admin')
     ->group(function () {
         Route::resource('user', 'UserController');
     });
 

Vulnerable code: Route::name('api.user.')->prefix('api/user')->middleware(['public.api'])->namespace('\MicroweberPackages\User\Http\Controllers')->group(function () {
    ->middleware(['api'])
    ->middleware(['admin'])
Fixed code: Route::name('api.user.')
    ->prefix('api/user')
    ->middleware([
        'public.api',
      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])
    ->namespace('\MicroweberPackages\User\Http\Controllers')
    ->group(function () {
    ->middleware([
        'api',
      //  \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])
    ->middleware([
        'admin',
       // \MicroweberPackages\App\Http\Middleware\VerifyCsrfToken::class,
        \MicroweberPackages\App\Http\Middleware\XSS::class
    ])