CVE-2019-12584: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Apcupsd 0.3.91_5, as used in pfSense through 2.4.4-RELEASE-p3 and other products, has an XSS issue in apcupsd_status.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-06-03T03:29Z
Repository: https://github.com/pfsense/FreeBSD-ports
Language: Other
Files changed: sysutils/pfSense-pkg-apcupsd/Makefile, sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
Commit date: 2019-05-28 10:24:36 -0400
Commit message: apcupsd: Validation and Encoding. Fixes #9556

Diff: diff --git a/sysutils/pfSense-pkg-apcupsd/Makefile b/sysutils/pfSense-pkg-apcupsd/Makefile
index 6531f6faee8e..c078e28d668e 100644
--- a/sysutils/pfSense-pkg-apcupsd/Makefile
+++ b/sysutils/pfSense-pkg-apcupsd/Makefile
@@ -1,10 +1,10 @@
 # $FreeBSD$
 
 PORTNAME=	pfSense-pkg-apcupsd
 PORTVERSION=	0.3.91
-PORTREVISION=	4
+PORTREVISION=	5
 CATEGORIES=	sysutils
 MASTER_SITES=	# empty
 DISTFILES=	# empty
 EXTRACT_ONLY=	# empty
 
diff --git a/sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php b/sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
index 480a18d23b23..030fc6f0eb0c 100755
--- a/sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
+++ b/sysutils/pfSense-pkg-apcupsd/files/usr/local/www/apcupsd_status.php
@@ -36,21 +36,25 @@ $tab_array[] = array(gettext("Status"), true, "/apcupsd_status.php");
 display_top_tabs($tab_array);
 
 $nis_server = check_nis_running_apcupsd();
 
 if ( $_POST['strapcaccess'] ) {
-	puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
-	puts("<pre>");
-	puts("Running: apcaccess -h {$_POST['strapcaccess']} <br />");
-	putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
-	$ph = popen("apcaccess -h {$_POST['strapcaccess']} 2>&1", "r" );
-	while ($line = fgets($ph)) {
-		echo htmlspecialchars($line);
+	if (is_hostname($_POST['strapcaccess'])) {
+		puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
+		puts("<pre>");
+		puts("Running: apcaccess -h " . htmlspecialchars($_POST['strapcaccess']) . " <br />");
+		putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
+		$ph = popen("apcaccess -h " . escapeshellarg($_POST['strapcaccess']) . " 2>&1", "r" );
+		while ($line = fgets($ph)) {
+			echo htmlspecialchars($line);
+		}
+		pclose($ph);
+		puts("</pre>");
+		puts("</div>");
+	} else {
+		print_input_errors(array(gettext("Invalid hostname or IP address")));
 	}
-	pclose($ph);
-	puts("</pre>");
-	puts("</div>");
 } elseif ($nis_server) {
 	$nisip = (check_nis_ip_apcupsd() != ''? check_nis_ip_apcupsd() : "localhost");
 	$nisport = (check_nis_port_apcupsd() != '' ? check_nis_port_apcupsd() : "3551");
 
 	puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");

Vulnerable code: PORTREVISION=	4
	puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
	puts("<pre>");
	puts("Running: apcaccess -h {$_POST['strapcaccess']} <br />");
	putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
	$ph = popen("apcaccess -h {$_POST['strapcaccess']} 2>&1", "r" );
	while ($line = fgets($ph)) {
		echo htmlspecialchars($line);
	pclose($ph);
	puts("</pre>");
	puts("</div>");
Fixed code: PORTREVISION=	5
	if (is_hostname($_POST['strapcaccess'])) {
		puts("<div class=\"panel panel-success responsive\"><div class=\"panel-heading\"><h2 class=\"panel-title\">Status information from apcupsd</h2></div>");
		puts("<pre>");
		puts("Running: apcaccess -h " . htmlspecialchars($_POST['strapcaccess']) . " <br />");
		putenv("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin");
		$ph = popen("apcaccess -h " . escapeshellarg($_POST['strapcaccess']) . " 2>&1", "r" );
		while ($line = fgets($ph)) {
			echo htmlspecialchars($line);
		}
		pclose($ph);
		puts("</pre>");
		puts("</div>");
	} else {
		print_input_errors(array(gettext("Invalid hostname or IP address")));