CVE-2022-24811: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Combodi iTop is a web based IT Service Management tool. Prior to versions 2.7.6 and 3.0.0, cross-site scripting is possible for scripts outside of script tags when displaying HTML attachments. This issue is fixed in versions 2.7.6 and 3.0.0. There are currently no known workarounds.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-05T19:15Z
Repository: https://github.com/Combodo/iTop
Language: PHP
Files changed: core/config.class.inc.php, datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php, pages/ajax.render.php
Commit date: 2021-08-18 15:57:18 +0200
Commit message: N°4129 - Security hardening

Diff: diff --git a/core/config.class.inc.php b/core/config.class.inc.php
index 42f4276a54..2f7508bae5 100644
--- a/core/config.class.inc.php
+++ b/core/config.class.inc.php
@@ -1159,10 +1159,18 @@ class Config
 			'default' => true,
 			'value' => true,
 			'source_of_value' => '',
 			'show_in_conf_sample' => false,
 		),
+		'security.disable_inline_documents_sandbox' => array(
+			'type' => 'bool',
+			'description' => 'If true then the sandbox for documents displayed in a browser tab will be disabled; enabling scripts and other interactive content. Note that setting this to true will open the application to potential XSS attacks!',
+			'default' => false,
+			'value' => false,
+			'source_of_value' => '',
+			'show_in_conf_sample' => false,
+		),
 	);
 
 	public function IsProperty($sPropCode)
 	{
 		return (array_key_exists($sPropCode, $this->m_aSettings));
diff --git a/datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php b/datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php
index 461d0e853f..41190d62cc 100644
--- a/datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php
+++ b/datamodels/2.x/itop-portal-base/portal/src/controllers/objectcontroller.class.inc.php
@@ -1293,10 +1293,15 @@ class ObjectController extends AbstractController
         /** @var \ormDocument $oDocument */
         $oDocument = $oObject->Get($sObjectField);
         $aHeaders['Content-Type'] = $oDocument->GetMimeType();
         $aHeaders['Content-Disposition'] = (($sOperation === 'display') ? 'inline' : 'attachment') . ';filename="'.$oDocument->GetFileName().'"';
 
+	    // N°4129 - Prevent XSS attacks & other script executions
+	    if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
+		    $aHeaders['Content-Security-Policy'] = 'sandbox';
+	    }
+
         return new Response($oDocument->GetData(), Response::HTTP_OK, $aHeaders);
     }
 
     /**
      * Handles attachment add/remove on an object
diff --git a/pages/ajax.render.php b/pages/ajax.render.php
index 41373f279d..766dfbf3ef 100644
--- a/pages/ajax.render.php
+++ b/pages/ajax.render.php
@@ -900,11 +900,16 @@ try
 		case 'display_document':
 			$id = utils::ReadParam('id', '');
 			$sField = utils::ReadParam('field', '');
 			if (!empty($sClass) && ($sClass != 'InlineImage') && !empty($id) && !empty($sField))
 			{
-				$oPage->add_header('X-Frame-Options:'); // resets header, see N°3416
+				// Resets header, see N°3416
+				$oPage->add_header('X-Frame-Options:');
+				// N°4129 - Prevent XSS attacks & other script executions
+				if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
+					$oPage->add_header('Content-Security-Policy: sandbox;');
+				}
 				ormDocument::DownloadDocument($oPage, $sClass, $id, $sField, 'inline');
 			}
 			break;
 
 		case 'search_form':

Vulnerable code: 				$oPage->add_header('X-Frame-Options:'); // resets header, see N°3416
Fixed code: 		'security.disable_inline_documents_sandbox' => array(
			'type' => 'bool',
			'description' => 'If true then the sandbox for documents displayed in a browser tab will be disabled; enabling scripts and other interactive content. Note that setting this to true will open the application to potential XSS attacks!',
			'default' => false,
			'value' => false,
			'source_of_value' => '',
			'show_in_conf_sample' => false,
		),
	    // N°4129 - Prevent XSS attacks & other script executions
	    if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
		    $aHeaders['Content-Security-Policy'] = 'sandbox';
	    }

				// Resets header, see N°3416
				$oPage->add_header('X-Frame-Options:');
				// N°4129 - Prevent XSS attacks & other script executions
				if (utils::GetConfig()->Get('security.disable_inline_documents_sandbox') === false) {
					$oPage->add_header('Content-Security-Policy: sandbox;');
				}