CVE-2021-25325: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP 2.4.136 has XSS via galaxy cluster element values to app/View/GalaxyElements/ajax/index.ctp. Reference types could contain javascript: URLs.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-01-19T16:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/GalaxyElements/ajax/index.ctp
Commit date: 2021-01-19 14:10:35 +0100
Commit message: fix: [security] XSS via galaxy cluster element values for reference types could contain javascript links

- ref type elements are automatically converted to links. A user would have to click a javascript: link for it to trigger, it's still too risky to keep as is
- only urls starting with http:// and https:// are converted from here on

- As reported by Patrik Kontura from ESET

Diff: diff --git a/app/View/GalaxyElements/ajax/index.ctp b/app/View/GalaxyElements/ajax/index.ctp
index de3307d622c..bed9900ca61 100755
--- a/app/View/GalaxyElements/ajax/index.ctp
+++ b/app/View/GalaxyElements/ajax/index.ctp
@@ -5,11 +5,11 @@
                 'update' => '#elements_div',
                 'evalScripts' => true,
                 'before' => '$(".progress").show()',
                 'complete' => '$(".progress").hide()',
         ));
-        
+
         echo $this->Paginator->prev('&laquo; ' . __('previous'), array('tag' => 'li', 'escape' => false), null, array('tag' => 'li', 'class' => 'prev disabled', 'escape' => false, 'disabledTag' => 'span'));
         echo $this->Paginator->numbers(array('modulus' => 20, 'separator' => '', 'tag' => 'li', 'currentClass' => 'active', 'currentTag' => 'span'));
         echo $this->Paginator->next(__('next') . ' &raquo;', array('tag' => 'li', 'escape' => false), null, array('tag' => 'li', 'class' => 'next disabled', 'escape' => false, 'disabledTag' => 'span'));
     ?>
     </ul>
@@ -23,21 +23,28 @@
 <?php
     foreach ($list as $item):
 ?>
         <tr>
             <td class="short"><?= h($item['GalaxyElement']['key']); ?></td>
-            <td class="short"><?php if ($item['GalaxyElement']['key'] === 'refs') {
+            <td class="short">
+            <?php if (
+                $item['GalaxyElement']['key'] === 'refs' &&
+                (
+                    substr($item['GalaxyElement']['value'], 0, 8) === 'https://' ||
+                    substr($item['GalaxyElement']['value'], 0, 7) === 'http://'
+                )
+            ) {
                 echo '<a href="' . h($item['GalaxyElement']['value']) . '" rel="noreferrer noopener">' . h($item['GalaxyElement']['value']) . '</a>';
             } else if ($item['GalaxyElement']['key'] === 'country') {
                 echo $this->Icon->countryFlag($item['GalaxyElement']['value']) . ' ' . h($item['GalaxyElement']['value']);
             } else {
                 echo h($item['GalaxyElement']['value']);
             }
             ?></td>
         </tr>
     <?php
-        endforeach; 
+        endforeach;
     ?>
 </table>
 <p>
 <?php
     echo $this->Paginator->counter(array('format' => __('Page {:page} of {:pages}, showing {:current} records out of {:count} total, starting on record {:start}, ending on {:end}')));

Vulnerable code:         
            <td class="short"><?php if ($item['GalaxyElement']['key'] === 'refs') {
        endforeach; 
Fixed code: 
            <td class="short">
            <?php if (
                $item['GalaxyElement']['key'] === 'refs' &&
                (
                    substr($item['GalaxyElement']['value'], 0, 8) === 'https://' ||
                    substr($item['GalaxyElement']['value'], 0, 7) === 'http://'
                )
            ) {
        endforeach;