CVE-2019-1010247: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c, Line: 3109. The fixed version is: 2.3.10.2.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-07-19T15:15Z
Repository: https://github.com/zmartzone/mod_auth_openidc
Language: Other
Files changed: ChangeLog, configure.ac, src/mod_auth_openidc.c
Commit date: 2019-01-22 11:52:16 +0100
Commit message: release 2.3.10.2: fix XSS vulnerability for poll parameter

in OIDC Session Management RP iframe; CSNC-2019-001; thanks Mischa
Bachmann

Signed-off-by: Hans Zandbelt <hans.zandbelt@zmartzone.eu>
Diff: diff --git a/ChangeLog b/ChangeLog
index 74baecc..5c15d3c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
+01/22/2019
+- fix XSS vulnerability CSNC-2019-001 wrt. poll parameter in OIDC Session Management RP iframe; thanks Mischa Bachmann
+- release 2.3.10.2
+
 01/16/2019
 - fix bug in current URL detection where query parameters would be duplicated; see #420; thanks @jreynaert
 - release 2.3.10.1
 
 12/31/2018
diff --git a/configure.ac b/configure.ac
index 0673a2e..700d6dd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,6 +1,6 @@
-AC_INIT([mod_auth_openidc],[2.3.10.1],[hans.zandbelt@zmartzone.eu])
+AC_INIT([mod_auth_openidc],[2.3.10.2],[hans.zandbelt@zmartzone.eu])
 
 AC_SUBST(NAMEVER, AC_PACKAGE_TARNAME()-AC_PACKAGE_VERSION())
 
 # This section defines the --with-apxs2 option.
 AC_ARG_WITH(
diff --git a/src/mod_auth_openidc.c b/src/mod_auth_openidc.c
index f2bbece..5b971d5 100644
--- a/src/mod_auth_openidc.c
+++ b/src/mod_auth_openidc.c
@@ -3104,11 +3104,11 @@ static int oidc_handle_session_management_iframe_rp(request_rec *r, oidc_cfg *c,
 			"        win.postMessage( message, targetOrigin);\n"
 			"      }\n"
 			"\n"
 			"      function setTimer() {\n"
 			"        checkSession();\n"
-			"        timerID = setInterval('checkSession()', %s);\n"
+			"        timerID = setInterval('checkSession()', %d);\n"
 			"      }\n"
 			"\n"
 			"      function receiveMessage(e) {\n"
 			"        console.debug('receiveMessage: ' + e.data + ' from ' + e.origin);\n"
 			"        if (e.origin !== targetOrigin ) {\n"
@@ -3147,16 +3147,17 @@ static int oidc_handle_session_management_iframe_rp(request_rec *r, oidc_cfg *c,
 		return DONE;
 	}
 
 	char *s_poll_interval = NULL;
 	oidc_util_get_request_parameter(r, "poll", &s_poll_interval);
-	if (s_poll_interval == NULL)
-		s_poll_interval = "3000";
+	int poll_interval = s_poll_interval ? strtol(s_poll_interval, NULL, 10) : 0;
+	if ((poll_interval <= 0) || (poll_interval > 3600 * 24))
+		poll_interval = 3000;
 
 	const char *redirect_uri = oidc_get_redirect_uri(r, c);
 	java_script = apr_psprintf(r->pool, java_script, origin, client_id,
-			session_state, op_iframe_id, s_poll_interval, redirect_uri,
+			session_state, op_iframe_id, poll_interval, redirect_uri,
 			redirect_uri);
 
 	return oidc_util_html_send(r, NULL, java_script, "setTimer", NULL, DONE);
 }
 

Vulnerable code: AC_INIT([mod_auth_openidc],[2.3.10.1],[hans.zandbelt@zmartzone.eu])
			"        timerID = setInterval('checkSession()', %s);\n"
	if (s_poll_interval == NULL)
		s_poll_interval = "3000";
			session_state, op_iframe_id, s_poll_interval, redirect_uri,
Fixed code: 01/22/2019
- fix XSS vulnerability CSNC-2019-001 wrt. poll parameter in OIDC Session Management RP iframe; thanks Mischa Bachmann
- release 2.3.10.2

AC_INIT([mod_auth_openidc],[2.3.10.2],[hans.zandbelt@zmartzone.eu])
			"        timerID = setInterval('checkSession()', %d);\n"
	int poll_interval = s_poll_interval ? strtol(s_poll_interval, NULL, 10) : 0;
	if ((poll_interval <= 0) || (poll_interval > 3600 * 24))
		poll_interval = 3000;
			session_state, op_iframe_id, poll_interval, redirect_uri,