CVE-2014-5451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in manager/templates/default/header.tpl in MODX Revolution 2.3.1-pl and earlier allows remote attackers to inject arbitrary web script or HTML via the "a" parameter to manager/.  NOTE: this issue exists because of a CVE-2014-2080 regression.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-11-06T18:55Z
Repository: https://github.com/modxcms/revolution
Language: Other
Files changed: core/docs/changelog.txt, manager/templates/default/header.tpl
Commit date: 2014-09-11 07:44:46 -0500
Commit message: Prevent XSS via $_GET param for controller action

Originally fixed in 2.2.x via https://github.com/modxcms/revolution/commit/77463eb6a8090f474b04fdc1b72225cb93c558ea - was reverted somehow

Should address #11966

Diff: diff --git a/core/docs/changelog.txt b/core/docs/changelog.txt
index 307cec543..6b890afe7 100644
--- a/core/docs/changelog.txt
+++ b/core/docs/changelog.txt
@@ -1,9 +1,10 @@
 
 This file shows the changes in recent releases of MODX. The most current release is usually the
 development release, and is only shown to give an idea of what's currently in the pipeline.
 
+- Prevent XSS via GET param for manager controller action [#11966]
 - Fix CRC icons in tree
 - Refresh/expand appropriate tree node when creating a resource using "quick create"
 - Limit property set name/description length
 - Added ability to update a namespace within a window
 - Use lexicon strings instead of hard coded ones in manager login form
diff --git a/manager/templates/default/header.tpl b/manager/templates/default/header.tpl
index 2cbc5520d..fd939af9a 100644
--- a/manager/templates/default/header.tpl
+++ b/manager/templates/default/header.tpl
@@ -15,12 +15,12 @@
 {else}
 <script src="{$_config.manager_url}assets/ext3/adapter/ext/ext-base.js" type="text/javascript"></script>
 <script src="{$_config.manager_url}assets/ext3/ext-all.js" type="text/javascript"></script>
 {/if}
 <script src="{$_config.manager_url}assets/modext/core/modx.js" type="text/javascript"></script>
-<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|strip_tags}" type="text/javascript"></script>
-<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|strip_tags}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>
+<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|htmlspecialchars}" type="text/javascript"></script>
+<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|htmlspecialchars}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>
 
 {if $_config.compress_js && $_config.compress_js_groups}
 <script src="{$_config.manager_url}min/index.php?g=coreJs1" type="text/javascript"></script>
 <script src="{$_config.manager_url}min/index.php?g=coreJs2" type="text/javascript"></script>
 <script src="{$_config.manager_url}min/index.php?g=coreJs3" type="text/javascript"></script>

Vulnerable code: <script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|strip_tags}" type="text/javascript"></script>
<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|strip_tags}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>
Fixed code: - Prevent XSS via GET param for manager controller action [#11966]
<script src="{$_config.connectors_url}lang.js.php?ctx=mgr&topic=topmenu,file,resource,{$_lang_topics}&action={$smarty.get.a|htmlspecialchars}" type="text/javascript"></script>
<script src="{$_config.connectors_url}modx.config.js.php?action={$smarty.get.a|htmlspecialchars}{if $_ctx}&wctx={$_ctx}{/if}" type="text/javascript"></script>