CVE-2023-24026: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2023-01-20T22:15Z
Repository: https://github.com/MISP/MISP
Language: JavaScript
Files changed: app/webroot/js/event-graph.js
Commit date: 2023-01-18 15:04:45 +0100
Commit message: fix: [security] XSS in eventgraph preview payload

- as reported by Cyber Controls from SIX Group

Diff: diff --git a/app/webroot/js/event-graph.js b/app/webroot/js/event-graph.js
index 97cf672e8b..150e9b6628 100644
--- a/app/webroot/js/event-graph.js
+++ b/app/webroot/js/event-graph.js
@@ -634,11 +634,11 @@ class EventGraph {
                 if (typeof preview == 'string') {
                     var btn_plot = $(tr).find('.btn-success');
                     btn_plot.data('network-preview', preview);
                     btn_plot.popover({
                         container: 'body',
-                        content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },
+                        content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },
                         placement: 'right',
                         trigger: 'hover',
                         template: '<div class="popover" role="tooltip"><div class="arrow"></div><h3 class="popover-title"></h3><div class="popover-content" style="width: 500px; height: 150px;"></div></div>',
                         html: true,
                     });
@@ -2000,11 +2000,11 @@ function reset_graph_history() {
             if (typeof preview == 'string') {
                 var btn_plot = $(tr).find('.btn-success');
                 btn_plot.data('network-preview', preview);
                 btn_plot.popover({
                     container: 'body',
-                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },
+                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },
                     placement: 'right',
                     trigger: 'hover',
                     template: '<div class="popover" role="tooltip"><div class="arrow"></div><h3 class="popover-title"></h3><div class="popover-content" style="width: 500px; height: 150px;"></div></div>',
                     html: true,
                 });

Vulnerable code:                         content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },
                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $(this).data('network-preview') + '" />'; },
Fixed code:                         content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },
                    content: function() { return '<img style="width: 500px; height: 150px;" src="' + $('<div>').text($(this).data('network-preview')).html() + '" />'; },