CVE-2017-11691: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in auth_profile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2017-07-27T06:29Z
Repository: https://github.com/Cacti/cacti
Language: PHP
Files changed: auth_profile.php, docs/CHANGELOG
Commit date: 2017-07-20 19:02:07 -0500
Commit message: Resolving Issue #867

Cross-site scripting (XSS) vulnerability in auth_profile.php

Diff: diff --git a/auth_profile.php b/auth_profile.php
index 25b8eee02..8c4db3ed9 100644
--- a/auth_profile.php
+++ b/auth_profile.php
@@ -145,11 +145,11 @@ function settings() {
 		$_SESSION['profile_referer'] = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER']:'graph_view.php');
 	}
 
 	form_start('auth_profile.php');
 
-	html_start_box( __('User Account Details'), '100%', true, '3', 'center', '');
+	html_start_box(__('User Account Details'), '100%', true, '3', 'center', '');
 
 	$current_user = db_fetch_row_prepared('SELECT * FROM user_auth WHERE id = ?', array($_SESSION['sess_user_id']));
 
 	if (!sizeof($current_user)) {
 		return;
@@ -416,19 +416,19 @@ function settings() {
 		$('#user_language').change(function() {
 			langChange();
 		});
 
 		$('input[value="<?php print __esc('Return');?>"]').unbind().click(function(event) {
-			document.location = '<?php print $_SESSION['profile_referer'];?>';
+			document.location = '<?php print htmlspecialchars($_SESSION['profile_referer']);?>';
 		});
 	});
 
 	</script>
 	<?php
 
 	form_hidden_box('save_component_graph_config','1','');
 
-	form_save_buttons(array(array('id' => 'return', 'value' => 'Return'), array('id' => 'save', 'value' => 'Save')));
+	form_save_buttons(array(array('id' => 'return', 'value' => __esc('Return')), array('id' => 'save', 'value' => __esc('Save'))));
 
 	form_end();
 }
 
diff --git a/docs/CHANGELOG b/docs/CHANGELOG
index dde6f5f27..0ca6fb4b7 100644
--- a/docs/CHANGELOG
+++ b/docs/CHANGELOG
@@ -4,10 +4,11 @@ Cacti CHANGELOG
 -issue#858: Pagination on SNMP Options wrong
 -issue#860: Network Discovery Subnet Range character limit too small
 -issue#861: The search filter does not support Cyrillic
 -issue#862: Automation - When editing Graph Rules, unable to Change Data Query
 -issue#863: Typo error in auth_login.php for LDAP authentication
+-issue#867: Cross-site scripting (XSS) vulnerability in auth_profile.php
 -issue: Link's not showing in Automation Graph and Tree rules on Sunshine theme
 -feature: Resize Graphs on Graph page to be responsive
 
 1.1.13
 -issue#605: Remove Spikes feature not fully functional

Vulnerable code: 	html_start_box( __('User Account Details'), '100%', true, '3', 'center', '');
			document.location = '<?php print $_SESSION['profile_referer'];?>';
	form_save_buttons(array(array('id' => 'return', 'value' => 'Return'), array('id' => 'save', 'value' => 'Save')));
Fixed code: 	html_start_box(__('User Account Details'), '100%', true, '3', 'center', '');
			document.location = '<?php print htmlspecialchars($_SESSION['profile_referer']);?>';
	form_save_buttons(array(array('id' => 'return', 'value' => __esc('Return')), array('id' => 'save', 'value' => __esc('Save'))));
-issue#867: Cross-site scripting (XSS) vulnerability in auth_profile.php