CVE-2022-3516: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-11-20T05:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/notifications.inc.php
Commit date: 2022-10-14 13:24:22 -0500
Commit message: Fix possible RSS XSS (#14457)

Escape titles when shown.  Body was already cleaned.
Diff: diff --git a/includes/html/pages/notifications.inc.php b/includes/html/pages/notifications.inc.php
index 0a172be326e..13ea55b52ca 100644
--- a/includes/html/pages/notifications.inc.php
+++ b/includes/html/pages/notifications.inc.php
@@ -82,11 +82,11 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
         }
         echo '<div class="well"><div class="row"> <div class="col-md-12">';
 
         $class = $notif['severity'] == 2 ? 'text-danger' : 'text-warning';
         echo "<h4 class='$class' id='${notif['notifications_id']}'>";
-        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;${notif['title']}</strong>";
+        echo "<strong><i class='fa fa-bell-o'></i>&nbsp;" . htmlentities($notif['title']) . '</strong>';
         echo "<span class='pull-right'>";
 
         if ($notif['user_id'] != Auth::id()) {
             $sticky_user = User::find($notif['user_id']);
             echo "<code>Sticky by {$sticky_user->username}</code>";
@@ -123,11 +123,11 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
         if ($notif['severity'] == 1) {
             $class = 'text-warning';
         } elseif ($notif['severity'] == 2) {
             $class = 'text-danger';
         }
-        echo "<h4 class='$class' id='${notif['notifications_id']}'>${notif['title']}<span class='pull-right'>";
+        echo "<h4 class='$class' id='${notif['notifications_id']}'>" . htmlentities($notif['title']) . "<span class='pull-right'>";
 
         if (Auth::user()->hasGlobalAdmin()) {
             echo '<button class="btn btn-primary fa fa-bell-o stick-notif" data-toggle="tooltip" data-placement="bottom" title="Mark as Sticky" style="margin-top:-10px;"></button>';
         } ?>
 
@@ -166,11 +166,11 @@ if ($notifications['count'] > 0 && ! isset($vars['archive'])) {
         if ($notif['severity'] == 1) {
             echo ' class="text-warning"';
         } elseif ($notif['severity'] == 2) {
             echo ' class="text-danger"';
         }
-        echo  " id='${notif['notifications_id']}'>${notif['title']}";
+        echo  " id='${notif['notifications_id']}'>" . htmlentities($notif['title']);
 
         if (Auth::user()->isAdmin()) {
             echo '<span class="pull-right"><button class="btn btn-primary fa fa-bell-o stick-notif" data-toggle="tooltip" data-placement="bottom" title="Mark as Sticky" style="margin-top:-10px;"></button></span>';
         } ?>
         </h4>

Vulnerable code:         echo "<strong><i class='fa fa-bell-o'></i>&nbsp;${notif['title']}</strong>";
        echo "<h4 class='$class' id='${notif['notifications_id']}'>${notif['title']}<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>${notif['title']}";
Fixed code:         echo "<strong><i class='fa fa-bell-o'></i>&nbsp;" . htmlentities($notif['title']) . '</strong>';
        echo "<h4 class='$class' id='${notif['notifications_id']}'>" . htmlentities($notif['title']) . "<span class='pull-right'>";
        echo  " id='${notif['notifications_id']}'>" . htmlentities($notif['title']);