CVE-2014-7264: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Multiple cross-site scripting (XSS) vulnerabilities in admin/themes/default/pages/manage_users.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user.email or (2) user.website field in a user registration.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-12-11T23:59Z
Repository: https://github.com/chyrp/chyrp
Language: Other
Files changed: admin/themes/default/pages/manage_users.twig
Commit date: 2014-11-17 01:02:40 +0100
Commit message: Fixed a potential XSS vulnerability.

Thanks JPCERT for reporting it to us.

Diff: diff --git a/admin/themes/default/pages/manage_users.twig b/admin/themes/default/pages/manage_users.twig
index 9711c4b3..6dca45cb 100644
--- a/admin/themes/default/pages/manage_users.twig
+++ b/admin/themes/default/pages/manage_users.twig
@@ -37,18 +37,18 @@
                 <tbody>
                 {% for user in users.paginated %}
                     <tr id="user_$user.id" class="user{% if loop.last %} last{% endif %}">
                         <td class="main">
                             {% if user.full_name != "" %}
-                            <a href="mailto:$user.email">$user.full_name</a> <span class="sub">($user.login)</span>
+                            <a href="mailto:${ user.email | escape }">$user.full_name</a> <span class="sub">($user.login)</span>
                             {% else %}
-                            <a href="mailto:$user.email">$user.login</a>
+                            <a href="mailto:${ user.email | escape }">$user.login</a>
                             {% endif %}
                         </td>
                         <td>${ user.group.name | escape }</td>
                         <td>${ user.joined_at | strftime }</td>
-                        <td>{% if user.website != "" %}<a href="$user.website">$user.website</a>{% endif %}</td>
+                        <td>{% if user.website != "" %}<a href="${ user.website | escape }">$user.website</a>{% endif %}</td>
                         ${ trigger.call("manage_users_column", user) }
                         {% if user.editable and user.deletable %}
                         <td class="controls">${ user.edit_link('<img src="'~ theme_url ~'/images/icons/edit.svg" alt="edit" /> '~("edit" | translate)) }</td>
                         <td class="controls">${ user.delete_link('<img src="'~ theme_url ~'/images/icons/delete.svg" alt="delete" /> '~("delete" | translate)) }</td>
                         {% else %}

Vulnerable code:                             <a href="mailto:$user.email">$user.full_name</a> <span class="sub">($user.login)</span>
                            <a href="mailto:$user.email">$user.login</a>
                        <td>{% if user.website != "" %}<a href="$user.website">$user.website</a>{% endif %}</td>
Fixed code:                             <a href="mailto:${ user.email | escape }">$user.full_name</a> <span class="sub">($user.login)</span>
                            <a href="mailto:${ user.email | escape }">$user.login</a>
                        <td>{% if user.website != "" %}<a href="${ user.website | escape }">$user.website</a>{% endif %}</td>