CVE-2022-32173: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-10-03T13:15Z
Repository: https://github.com/OrchardCMS/OrchardCore
Language: C#
Files changed: src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs, src/docs/reference/core/Sanitizer/README.md
Commit date: 2022-05-19 10:51:33 -0700
Commit message: Remove form tag from allowed tags during sanitization (#11729)


Diff: diff --git a/src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs b/src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs
index 010975f9f..35ef302e2 100644
--- a/src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs
+++ b/src/OrchardCore/OrchardCore.Infrastructure/Html/OrchardCoreBuilderExtensions.cs
@@ -15,10 +15,11 @@ namespace Microsoft.Extensions.DependencyInjection
                 services.AddOptions<HtmlSanitizerOptions>();
 
                 services.ConfigureHtmlSanitizer((sanitizer) =>
                 {
                     sanitizer.AllowedAttributes.Add("class");
+                    sanitizer.AllowedTags.Remove("form");
                 });
 
                 services.AddSingleton<IHtmlSanitizerService, HtmlSanitizerService>();
             });
 
diff --git a/src/docs/reference/core/Sanitizer/README.md b/src/docs/reference/core/Sanitizer/README.md
index 6b18d5a0d..f334ac173 100644
--- a/src/docs/reference/core/Sanitizer/README.md
+++ b/src/docs/reference/core/Sanitizer/README.md
@@ -16,17 +16,25 @@ It is used by default for the following parts and fields:
 
 ## Razor Helper
 
 `@Orchard.SanitizeHtml((string)Model.ContentItem.HtmlBodyPart.Html);`
 
+
+## Defaults configuration
+
+The elements sanitized by default are listed on this page: https://github.com/mganss/HtmlSanitizer#tags-allowed-by-default
+
+Orchard Core changes these defaults by:
+
+- allowing the attribute `class`
+- removing the tag `form`
+
 ## Configuring the Sanitizer
 
 The sanitizer is configurable using `IOptions<HtmlSanitizerOptions>` during service registration with a configuration 
 extension method `ConfigureHtmlSanitizer`.
 
-By default it allows css classes, but can be configured to accept other attributes.
-
 You may call this extension method multiple times during the startup pipeline to alter configurations.
 
 ```csharp
 services
     .AddOrchardCms()

Vulnerable code: By default it allows css classes, but can be configured to accept other attributes.

Fixed code:                     sanitizer.AllowedTags.Remove("form");

## Defaults configuration

The elements sanitized by default are listed on this page: https://github.com/mganss/HtmlSanitizer#tags-allowed-by-default

Orchard Core changes these defaults by:

- allowing the attribute `class`
- removing the tag `form`