CVE-2023-4980: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/pages/ports.inc.php
Commit date: 2023-09-14 00:19:12 -0500
Commit message: Fix injection vulnerability in ports pages (#15314)

* Fix injection vulnerability in ports pages
Unescaped output
reported by: https://huntr.dev/users/hainguyen0207

* fix style
Diff: diff --git a/includes/html/pages/ports.inc.php b/includes/html/pages/ports.inc.php
index 6bf04e4f07f..9ae818e446d 100644
--- a/includes/html/pages/ports.inc.php
+++ b/includes/html/pages/ports.inc.php
@@ -89,11 +89,11 @@ if ((isset($vars['searchbar']) && $vars['searchbar'] != 'hide') || ! isset($vars
     $output .= addslashes(csrf_field());
     $output .= "<div style='margin-bottom:4px;text-align:left;'>";
     $output .= "<div class='form-group'>";
     $output .= "<select name='device_id' id='device_id' class='form-control input-sm'></select>&nbsp;";
 
-    $hasvalue = ! empty($vars['hostname']) ? "value='" . $vars['hostname'] . "'" : '';
+    $hasvalue = ! empty($vars['hostname']) ? "value='" . htmlspecialchars($vars['hostname']) . "'" : '';
 
     $output .= "<input type='text' name='hostname' id='hostname' title='Hostname' class='form-control input-sm' " . $hasvalue . " placeholder='Hostname'>";
 
     $output .= '</div>&nbsp;';
 
@@ -191,11 +191,11 @@ if ((isset($vars['searchbar']) && $vars['searchbar'] != 'hide') || ! isset($vars
 
     $output .= '</select>&nbsp;';
     $output .= '</div>';
     $output .= "<div class='form-group'>";
 
-    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . $vars['ifAlias'] . "'" : '';
+    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . htmlspecialchars($vars['ifAlias']) . "'" : '';
 
     $output .= '</div>';
 
     $output .= '</div>';
     $output .= "<div style='text-align:left;'>";
@@ -243,11 +243,11 @@ if (isset($vars['purge'])) {
         });
     } else {
         try {
             Port::hasAccess(Auth::user())->where('port_id', $vars['purge'])->firstOrFail()->delete();
         } catch (ModelNotFoundException $e) {
-            echo "<div class='alert alert-danger'>Port ID {$vars['purge']} not found! Could not purge port.</div>";
+            echo "<div class='alert alert-danger'>Port ID " . htmlspecialchars($vars['purge']) . ' not found! Could not purge port.</div>';
         }
     }
 }
 
 [$format, $subformat] = explode('_', basename($vars['format']));

Vulnerable code:     $hasvalue = ! empty($vars['hostname']) ? "value='" . $vars['hostname'] . "'" : '';
    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . $vars['ifAlias'] . "'" : '';
            echo "<div class='alert alert-danger'>Port ID {$vars['purge']} not found! Could not purge port.</div>";
Fixed code:     $hasvalue = ! empty($vars['hostname']) ? "value='" . htmlspecialchars($vars['hostname']) . "'" : '';
    $ifaliasvalue = isset($vars['ifAlias']) ? "value='" . htmlspecialchars($vars['ifAlias']) . "'" : '';
            echo "<div class='alert alert-danger'>Port ID " . htmlspecialchars($vars['purge']) . ' not found! Could not purge port.</div>';