CVE-2022-4513: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing. The manipulation of the argument searchTag/resourceUri leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2022-06-27T0948 is able to address this issue. The name of the patch is a120c2153e263e62c4db34a06ab96a9f1c6bccb6. It is recommended to upgrade the affected component. The identifier VDB-215885 was assigned to this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-12-15T20:15Z
Repository: https://github.com/eea/eionet.contreg
Language: Java
Files changed: pom.xml, src/main/java/eionet/cr/web/action/TagSearchActionBean.java, src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
Commit date: 2022-06-27 09:49:55 +0300
Commit message: - Security upgrades for xss prevention

Diff: diff --git a/pom.xml b/pom.xml
index 61ce12aa..3b8a1731 100644
--- a/pom.xml
+++ b/pom.xml
@@ -941,10 +941,16 @@
             <artifactId>spring-test</artifactId>
             <version>${spring.version}</version>
             <scope>test</scope>
         </dependency>
 
+        <dependency>
+            <groupId>com.samaxes.stripes</groupId>
+            <artifactId>stripesafe</artifactId>
+            <version>1.0.1</version>
+        </dependency>
+
         <!-- PropertyPlaceholderConfigurer -->
         <dependency>
             <groupId>eionet</groupId>
             <artifactId>property-placeholder-resolver</artifactId>
             <version>1.0</version>
diff --git a/src/main/java/eionet/cr/web/action/TagSearchActionBean.java b/src/main/java/eionet/cr/web/action/TagSearchActionBean.java
index b679cab2..e1e43b6a 100644
--- a/src/main/java/eionet/cr/web/action/TagSearchActionBean.java
+++ b/src/main/java/eionet/cr/web/action/TagSearchActionBean.java
@@ -40,10 +40,11 @@ import eionet.cr.util.SortOrder;
 import eionet.cr.util.SortingRequest;
 import eionet.cr.util.pagination.PagingRequest;
 import eionet.cr.web.util.ApplicationCache;
 import eionet.cr.web.util.columns.SearchResultColumn;
 import eionet.cr.web.util.columns.SubjectPredicateColumn;
+import org.apache.commons.lang.StringEscapeUtils;
 
 /**
  *
  * @author <a href="mailto:enriko.kasper@tieto.com">Enriko Käsper</a>
  *
@@ -188,11 +189,12 @@ public class TagSearchActionBean extends AbstractSearchActionBean<SubjectDTO> {
     public String getSearchTag() {
         return searchTag;
     }
 
     public void setSearchTag(String searchTag) {
-        this.searchTag = searchTag;
+
+        this.searchTag = StringEscapeUtils.escapeHtml(searchTag);
     }
 
     public List<String> getSelectedTags() {
         return selectedTags;
     }
diff --git a/src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java b/src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
index 1a3ec72f..ea92bf13 100644
--- a/src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
+++ b/src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
@@ -423,11 +423,12 @@ public class FactsheetActionBean extends AbstractActionBean {
     /**
      * @param resourceUri
      *            the resourceUri to set
      */
     public void setUri(final String resourceUri) {
-        this.uri = resourceUri;
+
+        this.uri = StringEscapeUtils.escapeHtml(resourceUri);;
     }
 
     /**
      * @return the resource
      */

Vulnerable code:         this.searchTag = searchTag;
        this.uri = resourceUri;
Fixed code:         <dependency>
            <groupId>com.samaxes.stripes</groupId>
            <artifactId>stripesafe</artifactId>
            <version>1.0.1</version>
        </dependency>

import org.apache.commons.lang.StringEscapeUtils;

        this.searchTag = StringEscapeUtils.escapeHtml(searchTag);

        this.uri = StringEscapeUtils.escapeHtml(resourceUri);;