CVE-2022-31133: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: HumHub is an Open Source Enterprise Social Network. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, the attacker would need a permission to administer the Spaces feature. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. There are no known workarounds for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2022-07-07T18:15Z
Repository: https://github.com/humhub/humhub
Language: PHP
Files changed: protected/humhub/modules/space/widgets/FollowButton.php, protected/humhub/modules/space/widgets/MembershipButton.php, protected/humhub/modules/user/widgets/UserFollowButton.php
Commit date: 2022-07-05 13:33:36 +0200
Commit message: Fix space name in membership confirmation (#5790)

* Fix space name in membership confirmation

* Fix space name in membership confirmation

* Fix user name in unfollow confirmation
Diff: diff --git a/protected/humhub/modules/space/widgets/FollowButton.php b/protected/humhub/modules/space/widgets/FollowButton.php
index 2bf3045faf..4e3e0ed616 100644
--- a/protected/humhub/modules/space/widgets/FollowButton.php
+++ b/protected/humhub/modules/space/widgets/FollowButton.php
@@ -116,11 +116,11 @@ class FollowButton extends Widget
         $this->followOptions['data-ui-loader'] = '';
         $this->unfollowOptions['data-ui-loader'] = '';
 
         // Confirm action "Unfollow"
         $this->unfollowOptions['data-action-confirm'] = Yii::t('SpaceModule.base', 'Would you like to unfollow Space {spaceName}?', [
-            '{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>'
+            '{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>'
         ]);
 
         $module = Yii::$app->getModule('space');
 
         // still enable unfollow if following was disabled afterwards.
diff --git a/protected/humhub/modules/space/widgets/MembershipButton.php b/protected/humhub/modules/space/widgets/MembershipButton.php
index e04115022a..0567ac583f 100644
--- a/protected/humhub/modules/space/widgets/MembershipButton.php
+++ b/protected/humhub/modules/space/widgets/MembershipButton.php
@@ -10,10 +10,11 @@ namespace humhub\modules\space\widgets;
 
 use humhub\components\Widget;
 use humhub\modules\space\models\Space;
 use Yii;
 use yii\helpers\ArrayHelper;
+use yii\helpers\Html;
 use yii\helpers\Json;
 
 /**
  * MembershipButton shows various membership related buttons in space header. 
  *
@@ -82,11 +83,11 @@ class MembershipButton extends Widget
             'cancelPendingMembership' => [
                 'title' => '<span class="glyphicon glyphicon-time"></span>&nbsp;&nbsp;' . Yii::t('SpaceModule.base', 'Pending'),
                 'attrs' => [
                     'data-action-click' => 'content.container.relationship',
                     'data-action-url' => $this->space->createUrl('/space/membership/revoke-membership'),
-                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
+                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
                     'data-button-options' => Json::encode($this->options),
                     'data-ui-loader' => '',
                     'class' => 'btn btn-info active',
                 ],
             ],
@@ -94,11 +95,11 @@ class MembershipButton extends Widget
                 'visible' => false,
                 'title' => '<span class="glyphicon glyphicon-ok"></span>&nbsp;&nbsp;' . Yii::t('SpaceModule.base', 'Member'),
                 'attrs' => [
                     'data-action-click' => 'content.container.relationship',
                     'data-action-url' => $this->space->createUrl('/space/membership/revoke-membership'),
-                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
+                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
                     'data-button-options' => Json::encode($this->options),
                     'data-ui-loader' => '',
                     'class' => 'btn btn-info active',
                 ],
             ],
diff --git a/protected/humhub/modules/user/widgets/UserFollowButton.php b/protected/humhub/modules/user/widgets/UserFollowButton.php
index 8a1ba3a022..66eeed6e12 100644
--- a/protected/humhub/modules/user/widgets/UserFollowButton.php
+++ b/protected/humhub/modules/user/widgets/UserFollowButton.php
@@ -8,11 +8,10 @@
 
 namespace humhub\modules\user\widgets;
 
 use Yii;
 use yii\bootstrap\Html;
-use humhub\modules\friendship\models\Friendship;
 
 /**
  * UserFollowButton
  *
  * @author luke
@@ -111,11 +110,11 @@ class UserFollowButton extends \yii\base\Widget
         $this->followOptions['data-ui-loader'] = '';
         $this->unfollowOptions['data-ui-loader'] = '';
 
         // Confirm action "Unfollow"
         $this->unfollowOptions['data-action-confirm'] = Yii::t('SpaceModule.base', 'Would you like to unfollow {userName}?', [
-            '{userName}' => '<strong>' . $this->user->getDisplayName() . '</strong>'
+            '{userName}' => '<strong>' . Html::encode($this->user->getDisplayName()) . '</strong>'
         ]);
 
         $module = Yii::$app->getModule('user');
 
         // still enable unfollow if following was disabled afterwards.

Vulnerable code:             '{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>'
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . $this->space->getDisplayName() . '</strong>']),
use humhub\modules\friendship\models\Friendship;
            '{userName}' => '<strong>' . $this->user->getDisplayName() . '</strong>'
Fixed code:             '{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>'
use yii\helpers\Html;
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to withdraw your request to join Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
                    'data-action-confirm' => Yii::t('SpaceModule.base', 'Would you like to end your membership in Space {spaceName}?', ['{spaceName}' => '<strong>' . Html::encode($this->space->getDisplayName()) . '</strong>']),
            '{userName}' => '<strong>' . Html::encode($this->user->getDisplayName()) . '</strong>'