CVE-2020-25706: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: A cross-site scripting (XSS) vulnerability exists in templates_import.php (Cacti 1.2.13) due to Improper escaping of error message during template import preview in the xml_path field
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2020-11-12T14:15Z
Repository: https://github.com/Cacti/cacti
Language: Other
Files changed: CHANGELOG, lib/import.php
Commit date: 2020-07-26 23:40:44 +0000
Commit message: Improper escaping of error message leads to XSS during template import preview (#3723)

Closes #3723

Diff: diff --git a/CHANGELOG b/CHANGELOG
index 08ade23d7c..7fabcffac8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,10 +1,11 @@
 Cacti CHANGELOG
 
 1.2.14
 -issue#3695: Spikekill `percent` is converted from percent to decimal twice, making it 1/100 of the true size
 -issue#3676: Device not showing up in device page but showing up in Monitor tab (continued)
+-issue#3723: Improper escaping of error message leads to XSS during template import preview
 -feature#3619: Spikekill percent does not go high enough
 -feature#3615: Spikekill user options differ from Spikekill global options
 
 1.2.13
 -security#3544: jQuery XSS vulnerabilities require vendor package update (CVE-2020-11022 / CVE-2020-11023)
diff --git a/lib/import.php b/lib/import.php
index e41754d798..cd90da1666 100644
--- a/lib/import.php
+++ b/lib/import.php
@@ -979,11 +979,11 @@ function xml_to_data_query($hash, &$xml_array, &$hash_cache) {
 
 	if (isset($save['xml_path'])) {
 		$path = str_replace('<path_cacti>', $config['base_path'], $save['xml_path']);
 
 		if (!file_exists($path) || !is_readable($path)) {
-			raise_message('resource_missing_' . $counter, __('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
+			raise_message('resource_missing_' . $counter, __esc('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
 			$counter++;
 		}
 	}
 
 	/* check for status changes */
@@ -2088,11 +2088,11 @@ function import_display_results($import_debug_info, $filestatus, $web = false, $
 
 			print "<p><strong>" . __('Package Files') . "</strong></p>\n";
 
 			print "<ul>";
 			foreach($filestatus as $filename => $status) {
-				print "<li>" . ($preview ? __("[preview] "):"") . $filename . " [" . $status . "]</li>\n";
+				print "<li>" . ($preview ? __("[preview] "):"") . html_escape($filename) . " [" . $status . "]</li>\n";
 			}
 			print "</ul>";
 		} else {
 			if ($preview) {
 				print "<tr class='odd'><td><p class='textArea'>" . __('Cacti would make the following changes if the Template was imported:') . "</p>\n";

Vulnerable code: 			raise_message('resource_missing_' . $counter, __('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
				print "<li>" . ($preview ? __("[preview] "):"") . $filename . " [" . $status . "]</li>\n";
Fixed code: -issue#3723: Improper escaping of error message leads to XSS during template import preview
			raise_message('resource_missing_' . $counter, __esc('Resource File: \'%s\' is missing or not readable.  Make sure you install it before using Data Query: \'%s\'', $path, $save['name']), MESSAGE_LEVEL_ERROR);
				print "<li>" . ($preview ? __("[preview] "):"") . html_escape($filename) . " [" . $status . "]</li>\n";