CVE-2023-47622: Insufficient Information (NVD-CWE-noinfo)
value: iTop is an IT service management platform.  When dashlet are refreshed, XSS attacks are possible.  This vulnerability is fixed in 3.0.4 and 3.1.1.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-15T18:15Z
Repository: https://github.com/Combodo/iTop
Language: Other
Files changed: templates/application/display-block/block-chart-ajax-bars/layout.js.twig, templates/application/display-block/block-chart-ajax-pie/layout.js.twig, templates/application/display-block/block-csv/layout.js.twig
Commit date: 2023-11-13 11:19:02 +0100
Commit message: N°6908 - Security hardening

Diff: diff --git a/templates/application/display-block/block-chart-ajax-bars/layout.js.twig b/templates/application/display-block/block-chart-ajax-bars/layout.js.twig
index 8144a5407a9..c807cb0df44 100644
--- a/templates/application/display-block/block-chart-ajax-bars/layout.js.twig
+++ b/templates/application/display-block/block-chart-ajax-bars/layout.js.twig
@@ -59,10 +59,10 @@ if (typeof(charts) === "undefined")
     charts = [];
 	refreshChart = [];
 }
 var idxChart=charts.length;
 charts.push(chart);
-var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
+var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|escape('js') }}&refresh='+idxChart+'","", function (data) {'+
 														'charts['+idxChart+'].unload();'+
 														'setTimeout(function () {eval(data.js);},50);'+
 													'})';
 refreshChart.push(refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }});
\ No newline at end of file
diff --git a/templates/application/display-block/block-chart-ajax-pie/layout.js.twig b/templates/application/display-block/block-chart-ajax-pie/layout.js.twig
index cbe1902caab..cadea9a30c7 100644
--- a/templates/application/display-block/block-chart-ajax-pie/layout.js.twig
+++ b/templates/application/display-block/block-chart-ajax-pie/layout.js.twig
@@ -37,11 +37,11 @@ if (typeof (charts) === "undefined")
     charts = [];
     refreshChart = [];
 }
 var idxChart = charts.length;
 charts.push(chart);
-var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
+var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|escape('js')}}&refresh='+idxChart+'","", function (data) {'+
 															'charts['+idxChart+'].unload();'+
 															'setTimeout(function () {eval(data.js);},50);'+
 														'});';
 
 refreshChart.push(refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }});
\ No newline at end of file
diff --git a/templates/application/display-block/block-csv/layout.js.twig b/templates/application/display-block/block-csv/layout.js.twig
index 4529731751a..657c6fc9d26 100644
--- a/templates/application/display-block/block-csv/layout.js.twig
+++ b/templates/application/display-block/block-csv/layout.js.twig
@@ -1,10 +1,10 @@
 {# @copyright   Copyright (C) 2010-2021 Combodo SARL #}
 {# @license     http://opensource.org/licenses/AGPL-3.0 #}
 {% apply spaceless %}
 $.post(
-    '{{ oUIBlock.sAjaxLink|raw }}',
+    '{{ oUIBlock.sAjaxLink|escape('js') }}',
     {{ oUIBlock.sJsonParams|raw }},
     function(data) {
         $('#csv_content').html(data);
         $('#csv_content_loading').hide();
         $('#csv_content').show();

Vulnerable code: var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|raw }}&refresh='+idxChart+'","", function (data) {'+
    '{{ oUIBlock.sAjaxLink|raw }}',
Fixed code: var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }} = '$.post("{{ oUIBlock.sURLForRefresh|escape('js') }}&refresh='+idxChart+'","", function (data) {'+
var refreshChart{{ oUIBlock.sId|sanitize(constant('utils::ENUM_SANITIZATION_FILTER_VARIABLE_NAME')) }}='	$.post("{{ oUIBlock.sURLForRefresh|escape('js')}}&refresh='+idxChart+'","", function (data) {'+
    '{{ oUIBlock.sAjaxLink|escape('js') }}',