CVE-2015-5612: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2015-09-04T15:59Z
Repository: https://github.com/octobercms/october
Language: Other
Files changed: modules/backend/formwidgets/fileupload/partials/_file_multi.htm, modules/backend/formwidgets/fileupload/partials/_file_single.htm, modules/backend/formwidgets/fileupload/partials/_image_multi.htm, modules/backend/formwidgets/fileupload/partials/_image_single.htm
Commit date: 2015-07-22 10:41:51 +1000
Commit message: Escape file title - Fixes #1302

Diff: diff --git a/modules/backend/formwidgets/fileupload/partials/_file_multi.htm b/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
index 7b062ad0..f4baf305 100644
--- a/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
@@ -22,11 +22,11 @@
                 <div class="icon-container">
                     <i class="icon-file"></i>
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
+                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"
                             data-request="<?= $this->getEventHandler('onRemoveAttachment') ?>"
                             data-request-confirm="<?= e(trans('backend::lang.fileupload.remove_confirm')) ?>"
diff --git a/modules/backend/formwidgets/fileupload/partials/_file_single.htm b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
index 8830773c..ecc7225c 100644
--- a/modules/backend/formwidgets/fileupload/partials/_file_single.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
@@ -21,11 +21,11 @@
                 <div class="icon-container">
                     <i class="icon-file"></i>
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
+                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                     </h4>
                     <p class="size"><?= e($singleFile->sizeToString()) ?></p>
                 </div>
                 <div class="meta">
                     <a
diff --git a/modules/backend/formwidgets/fileupload/partials/_image_multi.htm b/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
index 27001789..5b9e76f0 100644
--- a/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
@@ -22,11 +22,11 @@
                 <div class="icon-container image">
                     <img src="<?= $file->thumbUrl ?>" />
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
+                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"
                             data-request="<?= $this->getEventHandler('onRemoveAttachment') ?>"
                             data-request-confirm="<?= e(trans('backend::lang.fileupload.remove_confirm')) ?>"
diff --git a/modules/backend/formwidgets/fileupload/partials/_image_single.htm b/modules/backend/formwidgets/fileupload/partials/_image_single.htm
index 7b62c194..78f88bd8 100644
--- a/modules/backend/formwidgets/fileupload/partials/_image_single.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_image_single.htm
@@ -26,11 +26,11 @@
                 <div class="icon-container image">
                     <img src="<?= $singleFile->thumbUrl ?>" />
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
+                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"
                             data-request="<?= $this->getEventHandler('onRemoveAttachment') ?>"
                             data-request-confirm="<?= e(trans('backend::lang.fileupload.remove_confirm')) ?>"

Vulnerable code:                         <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
Fixed code:                         <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>