CVE-2023-24070: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-23T05:15Z
Repository: https://github.com/MISP/MISP
Language: PHP
Files changed: app/Controller/Component/CRUDComponent.php, app/View/AuthKeys/authkey_display.ctp
Commit date: 2023-01-10 10:05:22 +0100
Commit message: fix: [security] XSS in authkey add

- as reported by Dawid Czarnecki from Zigrin Security

Diff: diff --git a/app/Controller/Component/CRUDComponent.php b/app/Controller/Component/CRUDComponent.php
index fb276e34d38..81ad2bfb1a7 100644
--- a/app/Controller/Component/CRUDComponent.php
+++ b/app/Controller/Component/CRUDComponent.php
@@ -112,11 +112,11 @@ class CRUDComponent extends Component
                     $this->Controller->restResponsePayload = $this->Controller->RestResponse->viewData($data, 'json');
                 } else {
                     $this->Controller->Flash->success($message);
                     if (!empty($params['displayOnSuccess'])) {
                         $this->Controller->set('entity', $data);
-                        $this->Controller->set('referer', $this->Controller->referer());
+                        $this->Controller->set('referer', $this->Controller->referer(['action' => 'view', $model->id], true));
                         $this->Controller->render($params['displayOnSuccess']);
                         return;
                     }
 
                     $redirect = isset($params['redirect']) ? $params['redirect'] : ['action' => 'index'];
diff --git a/app/View/AuthKeys/authkey_display.ctp b/app/View/AuthKeys/authkey_display.ctp
index 5cd4161d310..f64321798f0 100644
--- a/app/View/AuthKeys/authkey_display.ctp
+++ b/app/View/AuthKeys/authkey_display.ctp
@@ -10,19 +10,19 @@
                 <p><?= __('Please make sure that you note down the auth key below, this is the only time the auth key is shown in plain text, so make sure you save it. If you lose the key, simply remove the entry and generate a new one.'); ?></p>
                 <p><?=__('MISP will use the first and the last 4 characters for identification purposes.')?></p>
                 <pre class="quickSelect"><?= h($entity['AuthKey']['authkey_raw']) ?></pre>
             </div>
             <div class="modal-footer">
-                <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
+                <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
             </div>
         </div>
 <?php
     } else {
 ?>
         <h4><?= __('Auth key created'); ?></h4>
         <p><?= __('Please make sure that you note down the auth key below, this is the only time the auth key is shown in plain text, so make sure you save it. If you lose the key, simply remove the entry and generate a new one.'); ?></p>
         <p><?=__('MISP will use the first and the last 4 characters for identification purposes.')?></p>
         <pre class="quickSelect"><?= h($entity['AuthKey']['authkey_raw']) ?></pre>
-        <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
+        <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
 <?php
     }
 ?>

Vulnerable code:                         $this->Controller->set('referer', $this->Controller->referer());
                <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
        <a href="<?= $referer ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
Fixed code:                         $this->Controller->set('referer', $this->Controller->referer(['action' => 'view', $model->id], true));
                <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>
        <a href="<?= h($referer) ?>" class="btn btn-primary"><?= __('I have noted down my key, take me back now') ?></a>