CVE-2019-8953: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2019-02-20T16:29Z
Repository: https://github.com/pfsense/FreeBSD-ports
Language: Other
Files changed: net/pfSense-pkg-haproxy-devel/Makefile, net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php, net/pfSense-pkg-haproxy/Makefile, net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
Commit date: 2019-02-18 10:25:24 -0500
Commit message: Encoding for haproxy_listeners.php. Fixes #9335

Encode desc and table_actionsaclN before output.

Diff: diff --git a/net/pfSense-pkg-haproxy-devel/Makefile b/net/pfSense-pkg-haproxy-devel/Makefile
index 964d4a6f9e50..4653c0078d1e 100644
--- a/net/pfSense-pkg-haproxy-devel/Makefile
+++ b/net/pfSense-pkg-haproxy-devel/Makefile
@@ -1,10 +1,10 @@
 # $FreeBSD$
 
 PORTNAME=	pfSense-pkg-haproxy-devel
 PORTVERSION=	0.59
-PORTREVISION=	16
+PORTREVISION=	17
 CATEGORIES=	net
 MASTER_SITES=	# empty
 DISTFILES=	# empty
 EXTRACT_ONLY=	# empty
 
diff --git a/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php b/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php
index 3639f13658ce..a8c75e62045f 100644
--- a/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php
+++ b/net/pfSense-pkg-haproxy-devel/files/usr/local/www/haproxy/haproxy_listeners.php
@@ -365,11 +365,11 @@ function js_callback(req) {
 				  </td>
 				  <td>
 					<?=$frontend['name'];?>
 				  </td>
 				  <td>
-					<?=$frontend['desc'];?>
+					<?=htmlspecialchars($frontend['desc']);?>
 				  </td>
 				  <td>
 				    <?php
 						$first = true;
 						foreach($frontend['ipport'] as $addr) {
@@ -410,11 +410,11 @@ function js_callback(req) {
 							$backend = $actionitem['use_backendbackend'];
 							$hint = haproxy_userlist_backend_servers($backend);
 							echo "<div title='{$hint}'>";
 							echo "<a href='haproxy_pool_edit.php?id={$backend}'>{$backend}</a>";
 							if (!empty($actionitem['acl'])) {
-								echo "&nbsp;if({$actionitem['acl']})";
+								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
 							}
 							echo "<br/></div>";
 						}
 					}
 					$hint = haproxy_userlist_backend_servers($frontend['backend_serverpool']);
diff --git a/net/pfSense-pkg-haproxy/Makefile b/net/pfSense-pkg-haproxy/Makefile
index 8bfb32dd6e46..9310477b741d 100644
--- a/net/pfSense-pkg-haproxy/Makefile
+++ b/net/pfSense-pkg-haproxy/Makefile
@@ -1,10 +1,10 @@
 # $FreeBSD$
 
 PORTNAME=	pfSense-pkg-haproxy
 PORTVERSION=	0.59
-PORTREVISION=	15
+PORTREVISION=	16
 CATEGORIES=	net
 MASTER_SITES=	# empty
 DISTFILES=	# empty
 EXTRACT_ONLY=	# empty
 
diff --git a/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php b/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
index 3639f13658ce..a8c75e62045f 100644
--- a/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
+++ b/net/pfSense-pkg-haproxy/files/usr/local/www/haproxy/haproxy_listeners.php
@@ -365,11 +365,11 @@ function js_callback(req) {
 				  </td>
 				  <td>
 					<?=$frontend['name'];?>
 				  </td>
 				  <td>
-					<?=$frontend['desc'];?>
+					<?=htmlspecialchars($frontend['desc']);?>
 				  </td>
 				  <td>
 				    <?php
 						$first = true;
 						foreach($frontend['ipport'] as $addr) {
@@ -410,11 +410,11 @@ function js_callback(req) {
 							$backend = $actionitem['use_backendbackend'];
 							$hint = haproxy_userlist_backend_servers($backend);
 							echo "<div title='{$hint}'>";
 							echo "<a href='haproxy_pool_edit.php?id={$backend}'>{$backend}</a>";
 							if (!empty($actionitem['acl'])) {
-								echo "&nbsp;if({$actionitem['acl']})";
+								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
 							}
 							echo "<br/></div>";
 						}
 					}
 					$hint = haproxy_userlist_backend_servers($frontend['backend_serverpool']);

Vulnerable code: PORTREVISION=	16
					<?=$frontend['desc'];?>
								echo "&nbsp;if({$actionitem['acl']})";
PORTREVISION=	15
					<?=$frontend['desc'];?>
								echo "&nbsp;if({$actionitem['acl']})";
Fixed code: PORTREVISION=	17
					<?=htmlspecialchars($frontend['desc']);?>
								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";
PORTREVISION=	16
					<?=htmlspecialchars($frontend['desc']);?>
								echo "&nbsp;if(" . htmlspecialchars($actionitem['acl']) . ")";