CVE-2019-12347: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. The vulnerability occurs due to input validation errors.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-05-29T19:29Z
Repository: https://github.com/pfsense/FreeBSD-ports
Language: PHP
Files changed: security/pfSense-pkg-acme/Makefile, security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc, security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php, security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
Commit date: 2019-05-28 09:34:41 -0400
Commit message: ACME 0.5.8

* Fix encoding for cert/key fields in output. Fixes #9554
* Fix tab links for non-admin users. Fixes #9553

Diff: diff --git a/security/pfSense-pkg-acme/Makefile b/security/pfSense-pkg-acme/Makefile
index c3e013fd4bb0..1058321f20bc 100644
--- a/security/pfSense-pkg-acme/Makefile
+++ b/security/pfSense-pkg-acme/Makefile
@@ -1,10 +1,9 @@
 # $FreeBSD$
 
 PORTNAME=	pfSense-pkg-acme
-PORTVERSION=	0.5.7
-PORTREVISION=	1
+PORTVERSION=	0.5.8
 CATEGORIES=	security
 MASTER_SITES=	# empty
 DISTFILES=	# empty
 EXTRACT_ONLY=	# empty
 
diff --git a/security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc b/security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc
index 6098c09396e4..8c742c813e86 100644
--- a/security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc
+++ b/security/pfSense-pkg-acme/files/usr/local/pkg/acme/pkg_acme_tabs.inc
@@ -9,13 +9,13 @@
 namespace pfsense_pkg\acme;
 
 global $acme_tab_array;
 
 $acme_tab_array['acme'] = array();
-$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "acme_generalsettings.php");
-$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "acme_certificates.php");
-$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "acme_accountkeys.php");
+$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "/acme/acme_generalsettings.php");
+$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "/acme/acme_certificates.php");
+$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "/acme/acme_accountkeys.php");
 
 function display_top_tabs_active($top_tabs, $activetab) {
 	$tab_array = array();
 	foreach($top_tabs as $key => $tab_item){
 		$tab_array[] = array($tab_item['name'], $key == $activetab, $tab_item['url']);
diff --git a/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php b/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
index 6602670e96df..f293fac5e293 100644
--- a/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
+++ b/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys.php
@@ -156,25 +156,25 @@ display_top_tabs_active($acme_tab_array['acme'], "accountkeys");
 					</tr>
 				</thead>
 				<tbody class="user-entries">
 <?php
 		foreach ($a_accountkeys as $accountkey) {
-			$accountname = $accountkey['name'];
+			$accountname = htmlspecialchars($accountkey['name']);
 			?>
 			<tr id="fr<?=$accountname;?>" <?=$display?> onClick="fr_toggle('<?=$accountname;?>')" ondblclick="document.location='acme_accountkeys_edit.php?id=<?=$accountname;?>';">
 				<td>
 					<input type="checkbox" id="frc<?=$accountname;?>" onClick="fr_toggle('<?=$accountname;?>')" name="rule[]" value="<?=$accountname;?>"/>
 					<a class="fa fa-anchor" id="Xmove_<?=$accountname?>" title="<?=gettext("Move checked entries to here")?>"></a>
 				</td>
 			  <td>
-				<?=$accountkey['name'];?>
+				<?=$accountname;?>
 			  </td>
 			  <td>
-				<?=$accountkey['desc'];?>
+				<?=htmlspecialchars($accountkey['desc']);?>
 			  </td>
 			  <td>
-				<?=$accountkey['acmeserver'];?>
+				<?=htmlspecialchars($accountkey['acmeserver']);?>
 			  </td>
 			  <td class="action-icons">
 				<button style="display: none;" class="btn btn-default btn-xs" type="submit" id="move_<?=$accountname?>" name="move_<?=$accountname?>" value="move_<?=$accountname?>"></button>
 				<a href="acme_accountkeys_edit.php?id=<?=$accountname;?>">
 					<?=acmeicon("edit", gettext("edit"))?>
diff --git a/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php b/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
index 390b2f8c73e5..f44830a83a94 100644
--- a/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
+++ b/security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates.php
@@ -240,14 +240,14 @@ display_top_tabs_active($acme_tab_array['acme'], "certificates");
 			  </td>
 			  <td>
 				<?=$certificate['name'];?>
 			  </td>
 			  <td>
-				<?=$certificate['desc'];?>
+				<?=htmlspecialchars($certificate['desc']);?>
 			  </td>
 			  <td>
-				<?=$certificate['acmeaccount'];?>
+				<?=htmlspecialchars($certificate['acmeaccount']);?>
 			  </td>
 			  <td style="white-space: nowrap">
 				<?=date('r', $certificate['lastrenewal']);?>
 			  </td>
 			  <td>

Vulnerable code: PORTVERSION=	0.5.7
PORTREVISION=	1
$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "acme_generalsettings.php");
$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "acme_certificates.php");
$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "acme_accountkeys.php");
			$accountname = $accountkey['name'];
				<?=$accountkey['name'];?>
				<?=$accountkey['desc'];?>
				<?=$accountkey['acmeserver'];?>
				<?=$certificate['desc'];?>
				<?=$certificate['acmeaccount'];?>
Fixed code: PORTVERSION=	0.5.8
$acme_tab_array['acme']['settings'] = Array('name' => "General settings", 'url' => "/acme/acme_generalsettings.php");
$acme_tab_array['acme']['certificates'] = Array('name' => "Certificates", 'url' => "/acme/acme_certificates.php");
$acme_tab_array['acme']['accountkeys'] = Array('name' => "Account keys", 'url' => "/acme/acme_accountkeys.php");
			$accountname = htmlspecialchars($accountkey['name']);
				<?=$accountname;?>
				<?=htmlspecialchars($accountkey['desc']);?>
				<?=htmlspecialchars($accountkey['acmeserver']);?>
				<?=htmlspecialchars($certificate['desc']);?>
				<?=htmlspecialchars($certificate['acmeaccount']);?>