CVE-2020-24085: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability exists in MISP v2.4.128 in app/Controller/UserSettingsController.php at SetHomePage() function. Due to a lack of controller validation in "path" parameter, an attacker can execute malicious JavaScript code.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-01-26T18:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/UserSettingsController.php
Commit date: 2020-07-14 14:26:11 +0200
Commit message: fix: [security] xss fix missing part of solution

- the previous fix to the xss in the homepage setter was lacking the controller changes due to a partial commit (#bf4610c947c7dc372c4078f363d2dff6ae0703a8)

  - as originally discovered by Mislav Božičević <mislav.bozicevic@nn.cz>
  - persistence of the vulnerability after the lacking fix reported by DIEGO JURADO PALLARES from Ciberinteligencia

Diff: diff --git a/app/Controller/UserSettingsController.php b/app/Controller/UserSettingsController.php
index 20f519d5bba..62864e3464e 100644
--- a/app/Controller/UserSettingsController.php
+++ b/app/Controller/UserSettingsController.php
@@ -26,11 +26,10 @@ class UserSettingsController extends AppController
     );
 
     public function beforeFilter()
     {
         parent::beforeFilter();
-        $this->Security->unlockedActions = array_merge($this->Security->unlockedActions, array('setHomePage'));
     }
 
     public function index()
     {
         $filterData = array(
@@ -323,25 +322,29 @@ class UserSettingsController extends AppController
         }
     }
 
     public function setHomePage()
     {
-        if (!$this->request->is('post')) {
-            throw new MethodNotAllowedException(__('This endpoint only aaccepts POST requests.'));
-        }
-        if (empty($this->request->data['path'])) {
-            $this->request->data = array('path' => $this->request->data);
-        }
-        if (empty($this->request->data['path'])) {
-            throw new InvalidArgumentException(__('No path POSTed.'));
+        if ($this->request->is('post')) {
+            if (isset($this->request->data['UserSetting'])) {
+                $this->request->data = $this->request->data['UserSetting'];
+            }
+            if (!isset($this->request->data['path'])) {
+                $this->request->data = array('path' => $this->request->data);
+            }
+            if (empty($this->request->data['path'])) {
+                throw new InvalidArgumentException(__('No path POSTed.'));
+            }
+            $setting = array(
+                'UserSetting' => array(
+                    'user_id' => $this->Auth->user('id'),
+                    'setting' => 'homepage',
+                    'value' => json_encode(array('path' => $this->request->data['path']))
+                )
+            );
+            $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
+            return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
+        } else {
+            $this->layout = false;
         }
-        $setting = array(
-            'UserSetting' => array(
-                'user_id' => $this->Auth->user('id'),
-                'setting' => 'homepage',
-                'value' => json_encode(array('path' => $this->request->data['path']))
-            )
-        );
-        $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
-        return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
     }
 }

Vulnerable code:         $this->Security->unlockedActions = array_merge($this->Security->unlockedActions, array('setHomePage'));
        if (!$this->request->is('post')) {
            throw new MethodNotAllowedException(__('This endpoint only aaccepts POST requests.'));
        }
        if (empty($this->request->data['path'])) {
            $this->request->data = array('path' => $this->request->data);
        }
        if (empty($this->request->data['path'])) {
            throw new InvalidArgumentException(__('No path POSTed.'));
        $setting = array(
            'UserSetting' => array(
                'user_id' => $this->Auth->user('id'),
                'setting' => 'homepage',
                'value' => json_encode(array('path' => $this->request->data['path']))
            )
        );
        $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
        return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
Fixed code:         if ($this->request->is('post')) {
            if (isset($this->request->data['UserSetting'])) {
                $this->request->data = $this->request->data['UserSetting'];
            }
            if (!isset($this->request->data['path'])) {
                $this->request->data = array('path' => $this->request->data);
            }
            if (empty($this->request->data['path'])) {
                throw new InvalidArgumentException(__('No path POSTed.'));
            }
            $setting = array(
                'UserSetting' => array(
                    'user_id' => $this->Auth->user('id'),
                    'setting' => 'homepage',
                    'value' => json_encode(array('path' => $this->request->data['path']))
                )
            );
            $result = $this->UserSetting->setSetting($this->Auth->user(), $setting);
            return $this->RestResponse->saveSuccessResponse('UserSettings', 'setHomePage', false, $this->response->type(), 'Homepage set to ' . $this->request->data['path']);
        } else {
            $this->layout = false;