CVE-2023-37307: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-06-30T17:15Z
Repository: https://github.com/MISP/MISP
Language: Other
Files changed: app/View/CorrelationExclusions/top_correlations.ctp, app/View/Correlations/over_correlations.ctp, app/View/Correlations/top.ctp, app/View/Layouts/Emails/html/default.ctp, app/View/Layouts/default.ctp, app/View/Layouts/error.ctp
Commit date: 2023-06-06 15:54:56 -0400
Commit message: fix: [layout:title] Make sure page title are correctly formatted

Diff: diff --git a/app/View/CorrelationExclusions/top_correlations.ctp b/app/View/CorrelationExclusions/top_correlations.ctp
index ea6f6c13fcd..14982404f10 100644
--- a/app/View/CorrelationExclusions/top_correlations.ctp
+++ b/app/View/CorrelationExclusions/top_correlations.ctp
@@ -26,11 +26,11 @@
                     'name' => 'Correlation count',
                     'sort' => 'Correlation.count',
                     'data_path' => 'Correlation.count'
                 ]
             ],
-            'title' => empty($ajax) ? $title_for_layout : false,
+            'title' => empty($ajax) ? h($title_for_layout) : false,
             'description' => empty($ajax) ? __('The values with the most correlation entries.') : false,
             'pull' => 'right',
             'actions' => [
                 [
                     'onclick' => sprintf(
diff --git a/app/View/Correlations/over_correlations.ctp b/app/View/Correlations/over_correlations.ctp
index 8b68383f152..1d2ad6b9543 100644
--- a/app/View/Correlations/over_correlations.ctp
+++ b/app/View/Correlations/over_correlations.ctp
@@ -61,11 +61,11 @@ echo $this->element('genericElements/IndexTable/index_table', [
                 'data_path' => 'OverCorrelatingValue.excluded',
                 'class' => 'shortish',
                 'element' => 'boolean'
             ]
         ],
-        'title' => empty($ajax) ? $title_for_layout : false,
+        'title' => empty($ajax) ? h($title_for_layout) : false,
         'description' => empty($ajax) ? __('The values with the most correlation entries.') : false,
         'pull' => 'right',
         'actions' => [
             [
                 'onclick' => sprintf(
diff --git a/app/View/Correlations/top.ctp b/app/View/Correlations/top.ctp
index 1176f32d0e0..00c681dab11 100644
--- a/app/View/Correlations/top.ctp
+++ b/app/View/Correlations/top.ctp
@@ -41,11 +41,11 @@
                     'name' => 'Correlation count',
                     'data_path' => 'Correlation.count',
                     'class' => 'shortish'
                 ]
             ],
-            'title' => empty($ajax) ? $title_for_layout : false,
+            'title' => empty($ajax) ? h($title_for_layout) : false,
             'description' => empty($ajax) ? __('The values with the most correlation entries.') : false,
             'pull' => 'right',
             'actions' => [
                 [
                     'onclick' => sprintf(
diff --git a/app/View/Layouts/Emails/html/default.ctp b/app/View/Layouts/Emails/html/default.ctp
index bab97d11071..243dece7947 100644
--- a/app/View/Layouts/Emails/html/default.ctp
+++ b/app/View/Layouts/Emails/html/default.ctp
@@ -17,11 +17,11 @@
  */
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN">
 <html>
 <head>
-    <title><?php echo $title_for_layout;?></title>
+    <title><?php echo h($title_for_layout);?></title>
 </head>
 <body>
     <?php echo $this->fetch('content');?>
 
 </body>
diff --git a/app/View/Layouts/default.ctp b/app/View/Layouts/default.ctp
index e9dadf3e024..886b1cff2d9 100644
--- a/app/View/Layouts/default.ctp
+++ b/app/View/Layouts/default.ctp
@@ -3,11 +3,11 @@
 <head>
     <meta charset="utf-8">
     <meta http-equiv="X-UA-Compatible" content="IE=edge">
     <meta name="viewport" content="width=device-width">
     <link rel="shortcut icon" href="<?= $baseurl ?>/img/favicon.png">
-    <title><?= $title_for_layout, ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
+    <title><?= h($title_for_layout), ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
     <?php
         $css = [
             ['bootstrap', ['preload' => true]],
             ['bootstrap-datepicker', ['preload' => true]],
             ['bootstrap-colorpicker', ['preload' => true]],
diff --git a/app/View/Layouts/error.ctp b/app/View/Layouts/error.ctp
index 75aa100503a..89f37722eb5 100644
--- a/app/View/Layouts/error.ctp
+++ b/app/View/Layouts/error.ctp
@@ -22,11 +22,11 @@ $cakeDescription = __d('cake_dev', 'CakePHP: the rapid development php framework
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
     <?php echo $this->Html->charset(); ?>
     <title>
         <?php echo $cakeDescription ?>:
-        <?php echo $title_for_layout; ?>
+        <?php echo h($title_for_layout); ?>
     </title>
     <?php
         echo $this->Html->meta('icon');
 
         echo $this->Html->css('cake.generic');

Vulnerable code:             'title' => empty($ajax) ? $title_for_layout : false,
        'title' => empty($ajax) ? $title_for_layout : false,
            'title' => empty($ajax) ? $title_for_layout : false,
    <title><?php echo $title_for_layout;?></title>
    <title><?= $title_for_layout, ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
        <?php echo $title_for_layout; ?>
Fixed code:             'title' => empty($ajax) ? h($title_for_layout) : false,
        'title' => empty($ajax) ? h($title_for_layout) : false,
            'title' => empty($ajax) ? h($title_for_layout) : false,
    <title><?php echo h($title_for_layout);?></title>
    <title><?= h($title_for_layout), ' - ', h(Configure::read('MISP.title_text') ?: 'MISP') ?></title>
        <?php echo h($title_for_layout); ?>