CVE-2021-25324: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2021-01-19T16:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/GalaxyClusters/view.ctp
Commit date: 2021-01-19 14:09:17 +0100
Commit message: fix: [security] Stored XSS in the galaxy cluster view

- Galaxy cluster names were vulnerable to XSS injection

- As reported by Patrik Kontura of ESET

Diff: diff --git a/app/View/GalaxyClusters/view.ctp b/app/View/GalaxyClusters/view.ctp
index 1ef8e02aefc..ec53a34f7fa 100755
--- a/app/View/GalaxyClusters/view.ctp
+++ b/app/View/GalaxyClusters/view.ctp
@@ -56,19 +56,19 @@
     $table_data[] = array('key' => __('Distribution'), 'element' => 'genericElements/IndexTable/Fields/distribution_levels', 'element_params' => array(
         'row' => $cluster['GalaxyCluster'],
         'field' => array('data_path' => 'distribution')
     ));
     $table_data[] = array(
-        'key' => __('Owner Organisation'), 
+        'key' => __('Owner Organisation'),
         'html' => $this->OrgImg->getOrgImg(array('name' => $cluster['GalaxyCluster']['Org']['name'], 'id' => $cluster['GalaxyCluster']['Org']['id'], 'size' => 18), true),
     );
     $table_data[] = array(
-        'key' => __('Creator Organisation'), 
+        'key' => __('Creator Organisation'),
         'html' => $this->OrgImg->getOrgImg(array('name' => $cluster['GalaxyCluster']['Orgc']['name'], 'id' => $cluster['GalaxyCluster']['Orgc']['id'], 'size' => 18), true),
     );
     $table_data[] = array('key' => __('Connector tag'), 'value' => $cluster['GalaxyCluster']['tag_name']);
-    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ? 
+    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ?
                         sprintf('<a href="%s">%s</a>',
                             sprintf('%s/events/index/searchtag:%s', $baseurl, h($cluster['GalaxyCluster']['tag_id'])),
                             __n('%s event', '%s events', $cluster['GalaxyCluster']['tag_count'], h($cluster['GalaxyCluster']['tag_count']))
                         ):
                         '0'
@@ -83,11 +83,11 @@
 
 <div class='view'>
     <div class="row-fluid">
         <div class="span8">
             <h2>
-                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), $cluster['GalaxyCluster']['value']); ?>
+                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), h($cluster['GalaxyCluster']['value'])); ?>
             </h2>
             <?php echo $this->element('genericElements/viewMetaTable', array('table_data' => $table_data)); ?>
         </div>
     </div>
     <div class="row-fuild">

Vulnerable code:         'key' => __('Owner Organisation'), 
        'key' => __('Creator Organisation'), 
    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ? 
                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), $cluster['GalaxyCluster']['value']); ?>
Fixed code:         'key' => __('Owner Organisation'),
        'key' => __('Creator Organisation'),
    $table_data[] = array('key' => __('Events'), 'html' => isset($cluster['GalaxyCluster']['tag_count']) ?
                <?= sprintf('%s :: %s', h($cluster['GalaxyCluster']['Galaxy']['name']), h($cluster['GalaxyCluster']['value'])); ?>