CVE-2023-36666: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-06-25T22:15Z
Repository: https://github.com/inex/IXP-Manager
Language: PHP
Files changed: resources/views/console-server-connection/list-preamble.foil.php, resources/views/console-server-connection/page-header-preamble.foil.php, resources/views/contact/edit-form.foil.php, resources/views/contact/page-header-preamble.foil.php, resources/views/customer/overview.foil.php, resources/views/customer/tag/cust.foil.php, resources/views/log/view.foil.php
Commit date: 2023-06-20 08:49:45 +0100
Commit message: [BF] Fix a number of XSS issues

Thanks to the GRNET IT Security Team for responsibly disclosing these issues.

Diff: diff --git a/resources/views/console-server-connection/list-preamble.foil.php b/resources/views/console-server-connection/list-preamble.foil.php
index d9c67d13a..c5324d706 100644
--- a/resources/views/console-server-connection/list-preamble.foil.php
+++ b/resources/views/console-server-connection/list-preamble.foil.php
@@ -1,7 +1,7 @@
 <?php if( isset($t->data[ 'params'][ "cs" ]) ): ?>
     <div>
         <h2>
-            Ports for Console Server: <?= $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ?><br><br>
+            Ports for Console Server: <?= $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) ?><br><br>
         </h2>
     </div>
 <?php endif;?>
\ No newline at end of file
diff --git a/resources/views/console-server-connection/page-header-preamble.foil.php b/resources/views/console-server-connection/page-header-preamble.foil.php
index 25ff669ad..2ba23bbf8 100644
--- a/resources/views/console-server-connection/page-header-preamble.foil.php
+++ b/resources/views/console-server-connection/page-header-preamble.foil.php
@@ -1,19 +1,19 @@
 <?php if( !isset( $t->feParams->readonly ) || !$t->feParams->readonly ): ?>
     <div class="btn-group btn-group-sm" role="group">
         <div class="btn-group btn-group-sm">
             <button type="button" class="btn btn-white dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] : "All Console Server Ports" ?> <span class="caret"></span>
+                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) : "All Console Server Ports" ?> <span class="caret"></span>
             </button>
 
             <div class="dropdown-menu dropdown-menu-right scrollable-dropdown">
                 <a class="dropdown-item <?= isset($t->data[ 'params'][ "cs" ]) ? "" : "active" ?>" href="<?= route( "console-server-connection@list" ) ?>">
                     All Console Server Ports
                 </a>
                 <div class="dropdown-divider"></div>
                 <?php foreach( $t->data[ 'params'][ "css" ] as $css ): ?>
-                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $css[ 'name' ] ?></a>
+                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $t->ee( $css[ 'name' ] ) ?></a>
                 <?php endforeach; ?>
             </div>
         </div>
 
         <a  class="btn btn-white" href="<?= route($t->feParams->route_prefix.'@create' ) ?><?= isset( $t->data[ 'params'][ "cs" ] ) ? "?console_server_id=" . $t->data[ 'params'][ "cs" ] : ""  ?>">
diff --git a/resources/views/contact/edit-form.foil.php b/resources/views/contact/edit-form.foil.php
index df817c00f..4c9e9fac9 100644
--- a/resources/views/contact/edit-form.foil.php
+++ b/resources/views/contact/edit-form.foil.php
@@ -79,11 +79,11 @@
                                 <div class="form-group row">
                                     <div class="col-sm-6 col-md-6 col-lg-8 col-xl-6">
                                         <div class="form-check form-check-inline">
                                             <input id='role_<?= $role[ 'id' ] ?>' type='checkbox' name='roles[]' <?= in_array( $role[ 'id' ], $checkedRoles, false ) ? 'checked' : '' ?> value='<?= $role[ 'id' ] ?>'>
                                             <label for="role_<?= $role[ 'id' ] ?>" class="form-check-label">
-                                                <?= $role[ 'name' ] ?>
+                                                <?= $t->ee( $role[ 'name' ] ) ?>
                                             </label>
                                         </div>
                                     </div>
                                 </div>
                             <?php endforeach; ?>
diff --git a/resources/views/contact/page-header-preamble.foil.php b/resources/views/contact/page-header-preamble.foil.php
index 176547e14..cc370c59b 100644
--- a/resources/views/contact/page-header-preamble.foil.php
+++ b/resources/views/contact/page-header-preamble.foil.php
@@ -6,22 +6,22 @@
             </a>
         <?php endif; ?>
 
         <?php if( config('contact_group.types.ROLE') ): ?>
             <button type="button" class="btn btn-white dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
-                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name']  : "All Roles" ?>
+                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->ee( $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name'] ) : "All Roles" ?>
             </button>
             <ul class="dropdown-menu dropdown-menu-right">
                 <a class="dropdown-item <?= isset( $t->data[ 'params'][ "role" ]) ?: "active" ?>" href="<?= route( $t->feParams->route_prefix . "@list" ) ?>">
                     All Roles
                 </a>
 
                 <div class="dropdown-divider"></div>
 
                 <?php foreach( $t->data[ 'params'][ "roles" ] as $index => $role ): ?>
                     <a class="dropdown-item <?= isset($t->data[ 'params'][ "role" ]) && (int)$t->data[ 'params'][ "role" ] === $role[ 'id'] ? 'active' : '' ?>" href="<?= route( $t->feParams->route_prefix . "@list" ) ?>?role=<?= $role[ 'id' ] ?>">
-                        <?= $role[ 'name' ] ?>
+                        <?= $t->ee( $role[ 'name' ] ) ?>
                     </a>
                 <?php endforeach; ?>
             </ul>
         <?php endif;?>
 
diff --git a/resources/views/customer/overview.foil.php b/resources/views/customer/overview.foil.php
index ae95ad803..9ffcbcd88 100644
--- a/resources/views/customer/overview.foil.php
+++ b/resources/views/customer/overview.foil.php
@@ -154,11 +154,11 @@
                     <?php endif; ?>
 
                     <?php if( $c->tags ): ?>
                         <?php foreach( $c->tags as $tag ): ?>
                             <span class="badge badge-secondary">
-                                <?= $tag->display_as ?>
+                                <?= $t->ee( $tag->display_as ) ?>
                             </span>
                         <?php endforeach; ?>
 
                         <a class="btn btn-white btn-sm tw-rounded-full tw-text-xs" href="<?= route( 'customer-tag@link-customer', [ 'cust' => $c->id ] ) ?>">
                             Edit tags...
diff --git a/resources/views/customer/tag/cust.foil.php b/resources/views/customer/tag/cust.foil.php
index a9398787d..3d6e74695 100644
--- a/resources/views/customer/tag/cust.foil.php
+++ b/resources/views/customer/tag/cust.foil.php
@@ -29,15 +29,15 @@
                                 <label for="tags" class="control-label col-sm-2 col-2"> </label>
                                 <div class="col-sm-6 col-md-6 col-lg-8 col-xl-6">
                                     <div class="form-check form-check-inline">
                                         <input id='tag_<?= $tag->id ?>' type='checkbox' name='tags[]' <?= $t->c->tags->contains( 'id', $tag->id ) ? 'checked' : ''  ?> value='<?= $tag->id ?>'>
                                         <label for="tag_<?= $tag->id ?>" class="form-check-label">
-                                            <?= $tag->display_as . " (" . $tag->tag . ")" ?>
+                                            <?= $t->ee( $tag->display_as ) . " (" . $t->ee( $tag->tag ) . ")" ?>
                                         </label>
                                     </div>
                                   <small class="form-text text-muted former-help-text">
-                                      <?= $tag->description ?>
+                                      <?= $t->ee( $tag->description ) ?>
                                   </small>
                                 </div>
                             </div>
                         <?php endforeach; ?>
 
diff --git a/resources/views/log/view.foil.php b/resources/views/log/view.foil.php
index 09f6d742c..8ac2915e3 100644
--- a/resources/views/log/view.foil.php
+++ b/resources/views/log/view.foil.php
@@ -111,24 +111,24 @@
 
                                         <?php foreach( $keys as $key ): ?>
                                             <tr>
                                                 <td>
                                                     <b>
-                                                        <?= $key ?>
+                                                        <?= $t->ee( $key ) ?>
                                                     </b>
                                                 </td>
                                                 <?php if( $new ): ?>
                                                     <td class="<?= isset( $changed[ $key ] ) ? 'tw-bg-gray-500': '' ?> ">
-                                                        <?= $new[ $key ] ?>
+                                                        <?= $t->ee( $new[ $key ] ) ?>
                                                     </td>
                                                 <?php endif; ?>
                                                 <?php if( $old ): ?>
                                                     <td>
                                                         <?php if( !is_array( $old[ $key ] ) ): ?>
-                                                            <?= $old[ $key ] ?>
+                                                            <?= $t->ee( $old[ $key ] ) ?>
                                                         <?php else: ?>
-                                                            <?= json_encode($old[ $key ], JSON_THROW_ON_ERROR) ?>
+                                                            <?= json_encode($old[ $key ], JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_THROW_ON_ERROR) ?>
                                                         <?php endif; ?>
                                                     </td>
                                                 <?php endif; ?>
                                             </tr>
                                         <?php endforeach; ?>

Vulnerable code:             Ports for Console Server: <?= $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ?><br><br>
                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] : "All Console Server Ports" ?> <span class="caret"></span>
                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $css[ 'name' ] ?></a>
                                                <?= $role[ 'name' ] ?>
                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name']  : "All Roles" ?>
                        <?= $role[ 'name' ] ?>
                                <?= $tag->display_as ?>
                                            <?= $tag->display_as . " (" . $tag->tag . ")" ?>
                                      <?= $tag->description ?>
                                                        <?= $key ?>
                                                        <?= $new[ $key ] ?>
                                                            <?= $old[ $key ] ?>
                                                            <?= json_encode($old[ $key ], JSON_THROW_ON_ERROR) ?>
Fixed code:             Ports for Console Server: <?= $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) ?><br><br>
                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) : "All Console Server Ports" ?> <span class="caret"></span>
                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $t->ee( $css[ 'name' ] ) ?></a>
                                                <?= $t->ee( $role[ 'name' ] ) ?>
                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->ee( $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name'] ) : "All Roles" ?>
                        <?= $t->ee( $role[ 'name' ] ) ?>
                                <?= $t->ee( $tag->display_as ) ?>
                                            <?= $t->ee( $tag->display_as ) . " (" . $t->ee( $tag->tag ) . ")" ?>
                                      <?= $t->ee( $tag->description ) ?>
                                                        <?= $t->ee( $key ) ?>
                                                        <?= $t->ee( $new[ $key ] ) ?>
                                                            <?= $t->ee( $old[ $key ] ) ?>
                                                            <?= json_encode($old[ $key ], JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_THROW_ON_ERROR) ?>