CVE-2014-2260: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Cross-site scripting (XSS) vulnerability in plugins/main/content/js/ajenti.coffee in Eugene Pankov Ajenti 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via the command field in the Cron functionality.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2014-04-30T23:58Z
Repository: https://github.com/Eugeny/ajenti
Language: Other
Files changed: ajenti/plugins/main/content/js/ajenti.coffee, ajenti/plugins/main/content/js/controls.binding.coffee, ajenti/plugins/main/content/js/controls.inputs.coffee
Commit date: 2014-01-15 22:25:56 +0300
Commit message: [ui] fixes

Diff: diff --git a/ajenti/plugins/main/content/js/ajenti.coffee b/ajenti/plugins/main/content/js/ajenti.coffee
index 5844a063..bb8d7e41 100644
--- a/ajenti/plugins/main/content/js/ajenti.coffee
+++ b/ajenti/plugins/main/content/js/ajenti.coffee
@@ -320,12 +320,16 @@ class window.Control
         
         @html = @html.replace('<children>', children_html)
         
         
     s: (value) ->
-        # TODO SANITIZE!
-        value
+        ('' + value) /* Forces the conversion to string. */
+        .replace(/&/g, '&amp;') /* This MUST be the 1st replacement. */
+            .replace(/'/g, '&apos;') /* The 4 other predefined entities, required. */
+            .replace(/"/g, '&quot;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;')
 
     createDom: () ->
         ""
 
     setupDom: (dom) ->
diff --git a/ajenti/plugins/main/content/js/controls.binding.coffee b/ajenti/plugins/main/content/js/controls.binding.coffee
index 9f127b87..e0f0f0eb 100644
--- a/ajenti/plugins/main/content/js/controls.binding.coffee
+++ b/ajenti/plugins/main/content/js/controls.binding.coffee
@@ -4,6 +4,7 @@ class window.Controls.bind__template extends window.Control
         """<children>"""
 
     setupDom: (dom) ->
         super(dom)
         if @children.length > 0
-            @dom = @children[0].dom
\ No newline at end of file
+            @dom = @children[0].dom
+            @properties = @children[0].properties
\ No newline at end of file
diff --git a/ajenti/plugins/main/content/js/controls.inputs.coffee b/ajenti/plugins/main/content/js/controls.inputs.coffee
index a36c1536..89a392b1 100644
--- a/ajenti/plugins/main/content/js/controls.inputs.coffee
+++ b/ajenti/plugins/main/content/js/controls.inputs.coffee
@@ -229,11 +229,11 @@ class window.Controls.fileupload extends window.Control
 
     setupDom: (dom) ->
         super(dom)        
         @progress = new window.Controls.progressbar(@ui, {}, [])
         $(@dom).find('.pb').append($(@progress.dom))
-        @input = @dom.find('input')[0]
+        @input = $(@dom).find('input')[0]
         @input.addEventListener 'change', (e) =>
             file = @input.files[0]
             xhr = new XMLHttpRequest()
             xhr.file = file
             

Vulnerable code:         # TODO SANITIZE!
        value
            @dom = @children[0].dom
        @input = @dom.find('input')[0]
Fixed code:         ('' + value) /* Forces the conversion to string. */
        .replace(/&/g, '&amp;') /* This MUST be the 1st replacement. */
            .replace(/'/g, '&apos;') /* The 4 other predefined entities, required. */
            .replace(/"/g, '&quot;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            @dom = @children[0].dom
            @properties = @children[0].properties
        @input = $(@dom).find('input')[0]