CVE-2023-49289: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-12-05T00:15Z
Repository: https://github.com/michaelschwarz/Ajax.NET-Professional
Language: C#
Files changed: AjaxPro/Utilities/Constant.cs, AjaxPro/core.js
Commit date: 2021-12-22 09:24:12 +0100
Commit message: fixed another XSS issue

Diff: diff --git a/AjaxPro/Utilities/Constant.cs b/AjaxPro/Utilities/Constant.cs
index 42cf933..4b3c46c 100644
--- a/AjaxPro/Utilities/Constant.cs
+++ b/AjaxPro/Utilities/Constant.cs
@@ -50,8 +50,8 @@ namespace AjaxPro
 #endif
 
         /// <summary>
 		/// The assembly version.
 		/// </summary>
-        public const string AssemblyVersion = "21.12.21.2";
+        public const string AssemblyVersion = "21.12.22.1";
 	}
 }
diff --git a/AjaxPro/core.js b/AjaxPro/core.js
index dfe4698..aeeade2 100644
--- a/AjaxPro/core.js
+++ b/AjaxPro/core.js
@@ -177,11 +177,11 @@ Object.extend(AjaxPro, {
 		var date = str.substring(1).replace('"', '');
 		if (date.substring(0, 7) == "\\\/Date(") {
 			var d = date.match(/Date\((.*?)\)/)[1];
 			return "new Date(" + parseInt(d) + ")";
 		}
-		else { // ISO Date 2007-12-31T23:59:59Z                                     
+		/*else { // ISO Date 2007-12-31T23:59:59Z
 			var matches = date.split(/[-,:,T,Z]/);
 			if (matches.length == 7) {
 				matches[1] = (parseInt(matches[1], 0) - 1).toString();
 				var isDate = true;
 				var s = "";
@@ -192,25 +192,21 @@ Object.extend(AjaxPro, {
 					}
 					if (i > 0) {
 						s += ",";
                     }
 					s += parseInt(matches[i], 10);
+					console.log(s);
 				}
 				if (isDate) {
 					return "new Date(Date.UTC(" + s + "))";
 				}
 			}
-		}
+		}*/
 		return str;
 	},
 	parse: function (text) {
-		// not yet possible as we still return new type() JSON
-		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
-		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
-		//			throw new Error("Invalid characters in JSON parse string.");                 
-		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
-		text = text.replace(regEx, this.regExDate);
+		text = text.replace(/(\"\\\/Date\(\d+\)\\\/")/g, this.regExDate);
 		return eval('(' + text + ')');
 	},
 	m: {
 		'\b': '\\b',
 		'\t': '\\t',

Vulnerable code:         public const string AssemblyVersion = "21.12.21.2";
		else { // ISO Date 2007-12-31T23:59:59Z                                     
		}
		// not yet possible as we still return new type() JSON
		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
		//			throw new Error("Invalid characters in JSON parse string.");                 
		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
		text = text.replace(regEx, this.regExDate);
Fixed code:         public const string AssemblyVersion = "21.12.22.1";
		/*else { // ISO Date 2007-12-31T23:59:59Z
					console.log(s);
		}*/
		text = text.replace(/(\"\\\/Date\(\d+\)\\\/")/g, this.regExDate);