CVE-2018-25063: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability classified as problematic was found in Zenoss Dashboard up to 1.3.4. Affected by this vulnerability is an unknown functionality of the file ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js. The manipulation of the argument HTMLString leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.3.5 is able to address this issue. The identifier of the patch is f462285a0a2d7e1a9255b0820240b94a43b00a44. It is recommended to upgrade the affected component. The identifier VDB-217153 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-01T09:15Z
Repository: https://github.com/zenoss/ZenPacks.zenoss.Dashboard
Language: JavaScript
Files changed: ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js
Commit date: 2018-12-12 14:47:44 +0000
Commit message: ZEN-31099: sanitize html before inserting it

According to owasp there are some vulnerabilities if we insert raw html
without sanitizing it.
Create a blacklist of tags that are forbidden to use and whitelist
of attributes that can be used and then filter the html code.

Diff: diff --git a/ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js b/ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js
index 585c77f..2a3aecd 100644
--- a/ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js
+++ b/ZenPacks/zenoss/Dashboard/browser/resources/js/defaultportlets.js
@@ -304,11 +304,20 @@
                 fieldLabel: _t('Content'),
                 name: 'html',
                 value: this.content,
                 allowBlank: false,
                 height: 100,
-                width: 200
+                width: 200,
+                listeners: {
+                    afterrender: function(me) {
+                        Ext.tip.QuickTipManager.register({
+                            target: me.getId(),
+                            title : 'Warning',
+                            text  : 'Your HTML will be processed according to security rules'
+                        });
+                    }
+                }
             }];
             return fields;
         },
         onRefresh: function() {
             var me = this,
@@ -339,11 +348,11 @@
                 html: this.content
             };
         },
         convertToValidHTMLString: function (HTMLString) {
             var tempDiv = document.createElement('div');
-            tempDiv.innerHTML = HTMLString;
+            tempDiv.innerHTML = Zenoss.util.sanitizeHtml(HTMLString);
 
             return tempDiv.innerHTML;
         }
     });
 

Vulnerable code:                 width: 200
            tempDiv.innerHTML = HTMLString;
Fixed code:                 width: 200,
                listeners: {
                    afterrender: function(me) {
                        Ext.tip.QuickTipManager.register({
                            target: me.getId(),
                            title : 'Warning',
                            text  : 'Your HTML will be processed according to security rules'
                        });
                    }
                }
            tempDiv.innerHTML = Zenoss.util.sanitizeHtml(HTMLString);