CVE-2022-47928: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-22T23:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Templates/upload_file.ctp
Commit date: 2022-12-22 15:37:43 +0100
Commit message: fix: [security] XSS in the template file uploads

- as reported by Dawid Czarnecki from Zigrin Security

Diff: diff --git a/app/View/Templates/upload_file.ctp b/app/View/Templates/upload_file.ctp
index 77d68182ad..315b50be6e 100644
--- a/app/View/Templates/upload_file.ctp
+++ b/app/View/Templates/upload_file.ctp
@@ -4,11 +4,11 @@ if ($batch == 'yes') {
     $multiple = true;
 } else {
     $multiple = false;
     if (isset($filenames)) {
         $buttonText = __('Replace File');
-    } else {
+    } else {    
         $buttonText = __('Upload File');
     }
 }
 ?>
 <div style="display:none;">
@@ -16,16 +16,16 @@ if ($batch == 'yes') {
         echo $this->Form->create('', array('id' => 'upload_' . $element_id, 'type' => 'file'));
         echo $this->Form->input('file.', array('id' => 'upload_' . $element_id . '_file', 'type' => 'file', 'label' => false, 'multiple' => $multiple, 'onChange' => 'this.form.submit()'));
         echo $this->Form->end();
     ?>
 </div>
-<span id="fileUploadButton_<?php echo $element_id; ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse('<?php echo $element_id; ?>');"><?php echo $buttonText; ?></span>
+<span id="fileUploadButton_<?php echo h($element_id); ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse(<?php echo json_encode($element_id); ?>);"><?php echo $buttonText; ?></span>
 <script type="text/javascript">
 $(document).ready(function() {
     <?php if (isset($filenames)): ?>
     var fileArray = JSON.parse('<?php echo $fileArray;?>');
-    templateFileHiddenAdd(fileArray, '<?php echo $element_id; ?>', '<?php echo $batch; ?>');
-    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo $result; ?>', 'iframe');
+    templateFileHiddenAdd(fileArray, '<?php echo h($element_id); ?>', '<?php echo h($batch); ?>');
+    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo h($result); ?>', 'iframe');
     <?php endif; ?>
 });
 
 </script>

Vulnerable code:     } else {
<span id="fileUploadButton_<?php echo $element_id; ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse('<?php echo $element_id; ?>');"><?php echo $buttonText; ?></span>
    templateFileHiddenAdd(fileArray, '<?php echo $element_id; ?>', '<?php echo $batch; ?>');
    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo $result; ?>', 'iframe');
Fixed code:     } else {    
<span id="fileUploadButton_<?php echo h($element_id); ?>"  role="button" tabindex="0" aria-label="<?php echo $buttonText; ?>" title="<?php echo $buttonText; ?>" class="btn btn-primary" onClick="templateFileUploadTriggerBrowse(<?php echo json_encode($element_id); ?>);"><?php echo $buttonText; ?></span>
    templateFileHiddenAdd(fileArray, '<?php echo h($element_id); ?>', '<?php echo h($batch); ?>');
    showMessage('<?php echo $upload_error ? 'fail' : 'success'; ?>', '<?php echo h($result); ?>', 'iframe');