CVE-2023-4981: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2023-09-15T01:15Z
Repository: https://github.com/librenms/librenms
Language: PHP
Files changed: includes/html/common/eventlog.inc.php, includes/html/common/syslog.inc.php, includes/html/pages/eventlog.inc.php, includes/html/pages/syslog.inc.php
Commit date: 2023-09-14 00:07:08 -0500
Commit message: Fix another addcslashes incorrect escape in eventlog (#15313)

and many more
reported by: https://huntr.dev/users/hainguyen0207
Diff: diff --git a/includes/html/common/eventlog.inc.php b/includes/html/common/eventlog.inc.php
index b7cd728ec41..068f3d7f254 100644
--- a/includes/html/common/eventlog.inc.php
+++ b/includes/html/common/eventlog.inc.php
@@ -11,10 +11,12 @@
  * @link       https://www.librenms.org
  * @copyright  2017 LibreNMS
  * @author     LibreNMS Contributors
 */
 
+$vars['eventtype'] = 'test\"-alert(document.cookie)//';
+
 $common_output[] = '
 <div class="table-responsive">
     <table id="eventlog" class="table table-hover table-condensed table-striped">
         <thead>
             <tr>
@@ -34,11 +36,11 @@ var eventlog_grid = $("#eventlog").bootgrid({
     rowCount: [50, 100, 250, -1],
     post: function ()
     {
         return {
             device: ' . (empty($vars['device']) ? 'null' : (int) $vars['device']) . ',
-            eventtype: "' . addcslashes($vars['eventtype'] ?? '', '"') . '",
+            eventtype: "' . htmlspecialchars($vars['eventtype'] ?? '') . '",
         };
     },
     url: "' . url('/ajax/table/eventlog') . '"
 });
 
diff --git a/includes/html/common/syslog.inc.php b/includes/html/common/syslog.inc.php
index 5227307d807..89fe3f30cdb 100644
--- a/includes/html/common/syslog.inc.php
+++ b/includes/html/common/syslog.inc.php
@@ -35,15 +35,15 @@ var syslog_grid = $("#syslog").bootgrid({
     ajax: true,
     rowCount: [50, 100, 250, -1],
     post: function ()
     {
         return {
-            device: "' . addcslashes($vars['device'] ?? '', '"') . '",
-            program: "' . addcslashes($vars['program'] ?? '', '"') . '",
-            priority: "' . addcslashes($vars['priority'] ?? '', '"') . '",
-            to: "' . addcslashes($vars['to'] ?? '', '"') . '",
-            from: "' . addcslashes($vars['from'] ?? '', '"') . '",
+            device: "' . htmlspecialchars($vars['device'] ?? '') . '",
+            program: "' . htmlspecialchars($vars['program'] ?? '') . '",
+            priority: "' . htmlspecialchars($vars['priority'] ?? '') . '",
+            to: "' . htmlspecialchars($vars['to'] ?? '') . '",
+            from: "' . htmlspecialchars($vars['from'] ?? '') . '",
         };
     },
     url: "' . url('/ajax/table/syslog') . '"
 });
 
diff --git a/includes/html/pages/eventlog.inc.php b/includes/html/pages/eventlog.inc.php
index 0c1ba2993b9..a2aea40809f 100644
--- a/includes/html/pages/eventlog.inc.php
+++ b/includes/html/pages/eventlog.inc.php
@@ -104,8 +104,8 @@ $pagetitle[] = 'Eventlog';
                     term: params.term,
                     page: params.page || 1
                 }
             }
         }
-    })<?php echo Request::get('eventtype') ? ".val('" . addcslashes(Request::get('eventtype'), "'") . "').trigger('change');" : ''; ?>;
+    })<?php echo Request::get('eventtype') ? ".val('" . htmlspecialchars(Request::get('eventtype')) . "').trigger('change');" : ''; ?>;
 
 </script>
diff --git a/includes/html/pages/syslog.inc.php b/includes/html/pages/syslog.inc.php
index 8a09d579aae..834d8fa658f 100644
--- a/includes/html/pages/syslog.inc.php
+++ b/includes/html/pages/syslog.inc.php
@@ -169,11 +169,11 @@ $pagetitle[] = 'Syslog';
                     term: params.term,
                     page: params.page || 1
                 }
             }
         }
-    })<?php echo isset($vars['program']) ? ".val('" . addcslashes($vars['program'], "'") . "').trigger('change');" : ''; ?>;
+    })<?php echo isset($vars['program']) ? ".val('" . htmlspecialchars($vars['program']) . "').trigger('change');" : ''; ?>;
 
     $("#priority").select2({
         theme: "bootstrap",
         dropdownAutoWidth : true,
         width: "auto",
@@ -189,8 +189,8 @@ $pagetitle[] = 'Syslog';
                     term: params.term,
                     page: params.page || 1
                 }
             }
         }
-    })<?php echo isset($vars['priority']) ? ".val('" . addcslashes($vars['priority'], "'") . "').trigger('change');" : ''; ?>;
+    })<?php echo isset($vars['priority']) ? ".val('" . htmlspecialchars($vars['priority']) . "').trigger('change');" : ''; ?>;
 </script>
 

Vulnerable code:             eventtype: "' . addcslashes($vars['eventtype'] ?? '', '"') . '",
            device: "' . addcslashes($vars['device'] ?? '', '"') . '",
            program: "' . addcslashes($vars['program'] ?? '', '"') . '",
            priority: "' . addcslashes($vars['priority'] ?? '', '"') . '",
            to: "' . addcslashes($vars['to'] ?? '', '"') . '",
            from: "' . addcslashes($vars['from'] ?? '', '"') . '",
    })<?php echo Request::get('eventtype') ? ".val('" . addcslashes(Request::get('eventtype'), "'") . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['program']) ? ".val('" . addcslashes($vars['program'], "'") . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['priority']) ? ".val('" . addcslashes($vars['priority'], "'") . "').trigger('change');" : ''; ?>;
Fixed code: $vars['eventtype'] = 'test\"-alert(document.cookie)//';

            eventtype: "' . htmlspecialchars($vars['eventtype'] ?? '') . '",
            device: "' . htmlspecialchars($vars['device'] ?? '') . '",
            program: "' . htmlspecialchars($vars['program'] ?? '') . '",
            priority: "' . htmlspecialchars($vars['priority'] ?? '') . '",
            to: "' . htmlspecialchars($vars['to'] ?? '') . '",
            from: "' . htmlspecialchars($vars['from'] ?? '') . '",
    })<?php echo Request::get('eventtype') ? ".val('" . htmlspecialchars(Request::get('eventtype')) . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['program']) ? ".val('" . htmlspecialchars($vars['program']) . "').trigger('change');" : ''; ?>;
    })<?php echo isset($vars['priority']) ? ".val('" . htmlspecialchars($vars['priority']) . "').trigger('change');" : ''; ?>;