CVE-2019-14668: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2019-08-05T20:15Z
Repository: https://github.com/firefly-iii/firefly-iii
Language: Other
Files changed: resources/views/v1/transactions/links/delete.twig
Commit date: 2019-08-02 16:43:36 +0200
Commit message: Fix #2364

Diff: diff --git a/resources/views/v1/transactions/links/delete.twig b/resources/views/v1/transactions/links/delete.twig
index fad7391887..0f343125da 100644
--- a/resources/views/v1/transactions/links/delete.twig
+++ b/resources/views/v1/transactions/links/delete.twig
@@ -10,18 +10,18 @@
         <input name="_token" type="hidden" value="{{ csrf_token() }}">
         <div class="row">
             <div class="col-lg-6 col-lg-offset-3 col-md-6 col-sm-12">
                 <div class="box box-danger">
                     <div class="box-header with-border">
-                        <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
+                        <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
                     </div>
                     <div class="box-body">
                         <p class="text-danger">
                             {{ trans('form.permDeleteWarning') }}
                         </p>
                         <p>
-                            {{ trans('form.journal_link_areYouSure', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}
+                            {{ trans('form.journal_link_areYouSure', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}
                         </p>
                     </div>
                     <div class="box-footer">
                         <input type="submit" name="submit" value="{{ trans('form.deletePermanently') }}" class="btn pull-right btn-danger"/>
                         <a href="{{ URL.previous() }}" class="btn-default btn">{{ trans('form.cancel') }}</a>

Vulnerable code:                         <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
                            {{ trans('form.journal_link_areYouSure', {source: link.source.description, destination: link.destination.description, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}
Fixed code:                         <h3 class="box-title">{{ trans('firefly.delete_journal_link', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}</h3>
                            {{ trans('form.journal_link_areYouSure', {source: link.source.description|escape, destination: link.destination.description|escape, source_link: route('transactions.show', [link.source_id]) , destination_link: route('transactions.show',link.destination_id)})|raw }}