CVE-2015-5720: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in the template-creation feature in Malware Information Sharing Platform (MISP) before 2.3.90 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) add.ctp, (2) edit.ctp, and (3) ajaxification.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2016-09-03T20:59Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Templates/add.ctp, app/View/Templates/edit.ctp, app/webroot/js/ajaxification.js
Commit date: 2015-07-01 08:42:21 +0200
Commit message: Fix to XSS in the template creation process

Diff: diff --git a/app/View/Templates/add.ctp b/app/View/Templates/add.ctp
index 453f0593..37a9d827 100644
--- a/app/View/Templates/add.ctp
+++ b/app/View/Templates/add.ctp
@@ -54,11 +54,11 @@
 <script type="text/javascript">
 var selectedTags = [];
 var allTags = [
 	<?php 
 		foreach ($tagInfo as $tag) {
-			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";
+			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
 		}
 	?>
 ];
 </script>
 <?php echo $this->Js->writeBuffer();
\ No newline at end of file
diff --git a/app/View/Templates/edit.ctp b/app/View/Templates/edit.ctp
index 365782d6..dfb6519a 100644
--- a/app/View/Templates/edit.ctp
+++ b/app/View/Templates/edit.ctp
@@ -61,11 +61,11 @@ var selectedTags = [
 	?>
 ];
 var allTags = [
 	<?php 
 		foreach ($tagInfo as $tag) {
-			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";
+			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
 		}
 	?>
 ];
 $(document).ready( function () {
 	for (var i = 0, len = selectedTags.length; i < len; i++) {
diff --git a/app/webroot/js/ajaxification.js b/app/webroot/js/ajaxification.js
index 0ce6dd36..aebfac69 100644
--- a/app/webroot/js/ajaxification.js
+++ b/app/webroot/js/ajaxification.js
@@ -902,11 +902,17 @@ function templateFileHiddenAdd(files, element_id, batch) {
 			$('#TemplateFileArray', window.parent.document).val(JSON.stringify(fileArray));
 		}
 	}
 }
 
+function htmlEncode(value){
+	return $('<div/>').text(value).html();
+}
+
 function templateAddFileBubble(element_id, iframe, filename, tmp_name, batch) {
+	filename = htmlEncode(filename);
+	tmp_name = htmlEncode(tmp_name);
 	if (batch == 'no') {
 		if (iframe == true) {
 			$('#filenames_' + element_id, window.parent.document).html('<div id ="' + tmp_name + '_container" class ="template_file_box_container"><span class="tagFirstHalf template_file_box">' + filename + '</span><span onClick="templateDeleteFileBubble(\'' + filename + '\', \'' + tmp_name + '\', \'' + element_id + '\', \'normal\', \'no\');" class="tagSecondHalf useCursorPointer">x</span></div>');
 		} else {
 			$('#filenames_' + element_id).html('<div id ="' + tmp_name + '_container" class ="template_file_box_container"><span class="tagFirstHalf template_file_box">' + filename + '</span><span onClick="templateDeleteFileBubble(\'' + filename + '\', \'' + tmp_name + '\', \'' + element_id + '\', \'normal\', \'no\');" class="tagSecondHalf useCursorPointer">x</span></div>');

Vulnerable code: 			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";
			echo "{'id' : '" . $tag['Tags']['id'] . "', 'name' : '" . $tag['Tags']['name'] . "', 'colour' : '" . $tag['Tags']['colour'] . "'},";
Fixed code: 			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
			echo "{'id' : '" . h($tag['Tags']['id']) . "', 'name' : '" . h($tag['Tags']['name']) . "', 'colour' : '" . h($tag['Tags']['colour']) . "'},";
function htmlEncode(value){
	return $('<div/>').text(value).html();
}

	filename = htmlEncode(filename);
	tmp_name = htmlEncode(tmp_name);