CVE-2017-15216: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp and app/webroot/js/misp.js.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2017-10-10T18:29Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp, app/webroot/js/misp.js
Commit date: 2017-10-09 15:40:40 +0200
Commit message: fix: Fix to a potential reflected XSS on the quickDelete

- low impact, XSS required user confirmation of malicious payload

- as reported by Or Hanuka (PALANTIR)

Diff: diff --git a/app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp b/app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp
index fffcf7cea..db7acc819 100644
--- a/app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp
+++ b/app/View/Sightings/ajax/quickDeleteConfirmationForm.ctp
@@ -6,11 +6,11 @@
 	<div style="padding-left:5px;padding-right:5px;padding-bottom:5px;">
 	<p>Remove sighting (<?php echo h($id); ?>)?</p>
 		<table>
 			<tr>
 				<td style="vertical-align:top">
-					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" onClick="removeSighting('<?php echo h($id); ?>', '<?php echo h($rawId); ?>', '<?php echo h($context); ?>');">Yes</span>
+					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" data-id="<?php echo h($id); ?>" data-rawid="<?php echo h($rawId); ?>" data-context="<?php echo h($context); ?>" onClick="removeSighting(this);">Yes</span>
 				</td>
 				<td style="width:540px;">
 				</td>
 				<td style="vertical-align:top;">
 					<span role="button" tabindex="0" aria-label="Cancel" title="Cancel" class="btn btn-inverse" id="PromptNoButton" onClick="cancelPrompt(1);">No</span>
diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index 153adb4a1..ae6a70227 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -70,32 +70,10 @@ function cancelPrompt(isolated) {
 	}
 	$("#confirmation_box").fadeOut();
 	$("#confirmation_box").empty();
 }
 
-function submitEventDeletion() {
-	var formData = $('#PromptForm').serialize();
-	$.ajax({
-		beforeSend: function (XMLHttpRequest) {
-			$(".loading").show();
-		},
-		data: formData,
-		success:function (data, textStatus) {
-			updateIndex(context_id, context);
-			handleGenericAjaxResponse(data);
-		},
-		complete:function() {
-			$(".loading").hide();
-			$("#confirmation_box").fadeOut();
-			$("#gray_out").fadeOut();
-		},
-		type:"post",
-		cache: false,
-		url:"/" + type + "/" + action + "/" + id,
-	});
-}
-
 function submitDeletion(context_id, action, type, id) {
 	var context = 'event';
 	if (type == 'template_elements') context = 'template';
 	var formData = $('#PromptForm').serialize();
 	$.ajax({
@@ -116,11 +94,14 @@ function submitDeletion(context_id, action, type, id) {
 		cache: false,
 		url:"/" + type + "/" + action + "/" + id,
 	});
 }
 
-function removeSighting(id, rawid, context) {
+function removeSighting(caller) {
+	var id = $(caller).data('id');
+	var rawid = $(caller).data('rawid');
+	var context = $(caller).data('context');
 	if (context != 'attribute') {
 		context = 'event';
 	}
 	var formData = $('#PromptForm').serialize();
 	$.ajax({
@@ -128,20 +109,20 @@ function removeSighting(id, rawid, context) {
 			$(".loading").show();
 		},
 		data: formData,
 		success:function (data, textStatus) {
 			handleGenericAjaxResponse(data);
-		},
-		complete:function() {
-			$(".loading").hide();
-			$("#confirmation_box").fadeOut();
 			var org = "/" + $('#org_id').text();
 			updateIndex(id, 'event');
 			$.get( "/sightings/listSightings/" + rawid + "/" + context + org, function(data) {
 				$("#sightingsData").html(data);
 			});
 		},
+		complete:function() {
+			$(".loading").hide();
+			$("#confirmation_box").fadeOut();
+		},
 		type:"post",
 		cache: false,
 		url:"/sightings/quickDelete/" + id + "/" + rawid + "/" + context,
 	});
 }

Vulnerable code: 					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" onClick="removeSighting('<?php echo h($id); ?>', '<?php echo h($rawId); ?>', '<?php echo h($context); ?>');">Yes</span>
function submitEventDeletion() {
	var formData = $('#PromptForm').serialize();
	$.ajax({
		beforeSend: function (XMLHttpRequest) {
			$(".loading").show();
		},
		data: formData,
		success:function (data, textStatus) {
			updateIndex(context_id, context);
			handleGenericAjaxResponse(data);
		},
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();
			$("#gray_out").fadeOut();
		},
		type:"post",
		cache: false,
		url:"/" + type + "/" + action + "/" + id,
	});
}

function removeSighting(id, rawid, context) {
		},
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();
Fixed code: 					<span id="PromptYesButton" role="button" tabindex="0" aria-label="Remove sighting" title="Remove sighting" class="btn btn-primary" data-id="<?php echo h($id); ?>" data-rawid="<?php echo h($rawId); ?>" data-context="<?php echo h($context); ?>" onClick="removeSighting(this);">Yes</span>
function removeSighting(caller) {
	var id = $(caller).data('id');
	var rawid = $(caller).data('rawid');
	var context = $(caller).data('context');
		complete:function() {
			$(".loading").hide();
			$("#confirmation_box").fadeOut();
		},