CVE-2019-19856: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via the type parameter.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-01-15T23:15Z
Repository: https://github.com/SerpicoProject/Serpico
Language: Other
Files changed: views/add_user.haml, views/add_user_report.haml, views/list_user.haml
Commit date: 2019-12-31 11:51:41 -0500
Commit message: rack protection updates

Diff: diff --git a/views/add_user.haml b/views/add_user.haml
index adc940b..3139a1a 100644
--- a/views/add_user.haml
+++ b/views/add_user.haml
@@ -48,8 +48,9 @@
         - else
           %option{ :selected => "selected" } User
           %option Administrator
 
   %br
+  %input#authenticity-token{:type => "hidden", :name => "authenticity_token", :value => "#{env['rack.session'][:csrf]}" }
   %input.btn.btn-primary{ :type => "submit", :value => "Add" }
   %a.btn.btn-secondary{ :href => "/admin/list_user" }
     Cancel
diff --git a/views/add_user_report.haml b/views/add_user_report.haml
index f79a784..e7937f0 100644
--- a/views/add_user_report.haml
+++ b/views/add_user_report.haml
@@ -1,7 +1,7 @@
 .d-flex.justify-content-between.flex-wrap.flex-md-nowrap.align-items-center.pt-3.pb-2.mb-3.border-bottom
-  %h1.h2 Editing #{@report.report_name} Report
+  %h1.h2 Editing #{@report.report_name} Report FFFF
 
 %h2.h4 Current Authors
 .table-responsive.col-6.px-0
   %table.table.table-striped.table-sm
     %tbody
@@ -12,11 +12,12 @@
           &nbsp;
       - if @report.authors
         - @report.authors.each do |user|
           %tr
             %td
-              #{user}
+              :escaped
+                #{user}
             %td.text-right
               %a.btn.btn-sm.btn-danger{ :href => "/admin/del_user_report/#{@report.id}/#{user}" }
                 %i.far.fa-trash-alt{ :title => "Remove Author" }
 
 %br
diff --git a/views/list_user.haml b/views/list_user.haml
index 782d843..cd0d01f 100644
--- a/views/list_user.haml
+++ b/views/list_user.haml
@@ -14,13 +14,15 @@
             %b Actions
       %tbody
         - @users.each do |user|
           %tr
             %td
-              #{user.username}
+              :escaped
+                #{user.username}
             %td
-              #{user.type} / #{user.auth_type}
+              :escaped
+                #{user.type} / #{user.auth_type}
             %td.text-right
               %a.btn.btn-sm.btn-warning{ :href => "/admin/edit_user/#{user.id}" }
                 %i.fas.fa-pencil-alt{ :title => "Edit Password" }
               %a.btn.btn-sm.btn-danger{ :href => "/admin/delete/#{user.id}" }
                 %i.far.fa-trash-alt{ :title => "Delete User" }

Vulnerable code:   %h1.h2 Editing #{@report.report_name} Report
              #{user}
              #{user.username}
              #{user.type} / #{user.auth_type}
Fixed code:   %input#authenticity-token{:type => "hidden", :name => "authenticity_token", :value => "#{env['rack.session'][:csrf]}" }
  %h1.h2 Editing #{@report.report_name} Report FFFF
              :escaped
                #{user}
              :escaped
                #{user.username}
              :escaped
                #{user.type} / #{user.auth_type}