CVE-2022-1682: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-05-12T09:15Z
Repository: https://github.com/neorazorx/facturascripts
Language: PHP
Files changed: Core/Controller/EditPageOption.php
Commit date: 2022-05-10 00:12:41 +0200
Commit message: We check the url parameter of the link to ensure that it is a valid controller.
------
Comprobamos el parámetro url del enlace para asegurar que sea un controlador válido.

Diff: diff --git a/Core/Controller/EditPageOption.php b/Core/Controller/EditPageOption.php
index a9b620f8d3..b8cb64a839 100644
--- a/Core/Controller/EditPageOption.php
+++ b/Core/Controller/EditPageOption.php
@@ -22,10 +22,11 @@ namespace FacturaScripts\Core\Controller;
 use FacturaScripts\Core\Base\Controller;
 use FacturaScripts\Core\Base\ControllerPermissions;
 use FacturaScripts\Core\Base\DataBase\DataBaseWhere;
 use FacturaScripts\Core\Lib\Widget\VisualItemLoadEngine;
 use FacturaScripts\Dinamic\Model\CodeModel;
+use FacturaScripts\Dinamic\Model\Page;
 use FacturaScripts\Dinamic\Model\PageOption;
 use FacturaScripts\Dinamic\Model\User;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
@@ -119,11 +120,11 @@ class EditPageOption extends Controller
     public function privateCore(&$response, $user, $permissions)
     {
         parent::privateCore($response, $user, $permissions);
         $this->model = new PageOption();
         $this->loadSelectedViewName();
-        $this->backPage = $this->request->get('url') ?: $this->selectedViewName;
+        $this->setBackPage();
         $this->selectedUser = $this->user->admin ? $this->request->get('nick') : $this->user->nick;
         $this->loadPageOptions();
 
         $action = $this->request->get('action', '');
         switch ($action) {
@@ -273,10 +274,26 @@ class EditPageOption extends Controller
         $this->model->id = null;
         $this->model->nick = $this->selectedUser;
         return true;
     }
 
+    private function setBackPage()
+    {
+        // check if the url is a real controller name
+        $url = $this->request->get('url', '');
+        $pageModel = new Page();
+        foreach ($pageModel->all([], [], 0, 0) as $page) {
+            if (substr($url, 0, strlen($page->name)) === $page->name) {
+                $this->backPage = $url;
+                return;
+            }
+        }
+
+        // set the default back page
+        $this->backPage = $this->selectedViewName;
+    }
+
     /**
      * @param array $column
      * @param string $name
      * @param string $key
      * @param bool $isWidget

Vulnerable code:         $this->backPage = $this->request->get('url') ?: $this->selectedViewName;
Fixed code: use FacturaScripts\Dinamic\Model\Page;
        $this->setBackPage();
    private function setBackPage()
    {
        // check if the url is a real controller name
        $url = $this->request->get('url', '');
        $pageModel = new Page();
        foreach ($pageModel->all([], [], 0, 0) as $page) {
            if (substr($url, 0, strlen($page->name)) === $page->name) {
                $this->backPage = $url;
                return;
            }
        }

        // set the default back page
        $this->backPage = $this->selectedViewName;
    }