CVE-2023-39521: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. An agile dashboard administrator deleting a kanban with a malicious label can be forced to execute uncontrolled code. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2023-08-24T23:15Z
Repository: https://github.com/Enalean/tuleap
Language: JavaScript
Files changed: plugins/kanban/scripts/kanban/po/fr_FR.po, plugins/kanban/scripts/kanban/src/app/kanban-service.js
Commit date: 2023-08-07 10:18:32 +0200
Commit message: Fixes request #33656: XSS on the success message of a kanban deletion

Change-Id: I148a41056a269bb5b232c8a924db759401fb2b44

Diff: diff --git a/plugins/kanban/scripts/kanban/po/fr_FR.po b/plugins/kanban/scripts/kanban/po/fr_FR.po
index e5505d69f623..bdce84304451 100644
--- a/plugins/kanban/scripts/kanban/po/fr_FR.po
+++ b/plugins/kanban/scripts/kanban/po/fr_FR.po
@@ -108,11 +108,11 @@ msgid "In column since:"
 msgstr "Dans la colonne depuis :"
 
 msgid "Kanban label:"
 msgstr "Label du Kanban :"
 
-msgid "Kanban {{ label }} successfuly deleted"
+msgid "Kanban {{ label }} successfully deleted"
 msgstr "Le Kanban {{ label }} a été supprimé"
 
 msgid "Last 3 months"
 msgstr "3 derniers mois"
 
diff --git a/plugins/kanban/scripts/kanban/src/app/kanban-service.js b/plugins/kanban/scripts/kanban/src/app/kanban-service.js
index 77aff1ebe7cb..4525bbbd1e04 100644
--- a/plugins/kanban/scripts/kanban/src/app/kanban-service.js
+++ b/plugins/kanban/scripts/kanban/src/app/kanban-service.js
@@ -16,10 +16,11 @@
  * You should have received a copy of the GNU General Public License
  * along with Tuleap. If not, see <http://www.gnu.org/licenses/>.
  */
 
 import { get, head, patch, del, post, put } from "@tuleap/tlp-fetch";
+import { escaper } from "@tuleap/html-escaper";
 
 export default KanbanService;
 
 KanbanService.$inject = [
     "$q",
@@ -337,12 +338,12 @@ function KanbanService(
     function updateKanbanName(label) {
         SharedPropertiesService.getKanban().label = label;
     }
 
     function removeKanban() {
-        var message = gettextCatalog.getString("Kanban {{ label }} successfuly deleted", {
-            label: SharedPropertiesService.getKanban().label,
+        const message = gettextCatalog.getString("Kanban {{ label }} successfully deleted", {
+            label: escaper.html(SharedPropertiesService.getKanban().label),
         });
         $window.sessionStorage.setItem("tuleap_feedback", message);
         $window.location.href =
             "/plugins/agiledashboard/?group_id=" + SharedPropertiesService.getProjectId();
     }

Vulnerable code: msgid "Kanban {{ label }} successfuly deleted"
        var message = gettextCatalog.getString("Kanban {{ label }} successfuly deleted", {
            label: SharedPropertiesService.getKanban().label,
Fixed code: msgid "Kanban {{ label }} successfully deleted"
import { escaper } from "@tuleap/html-escaper";
        const message = gettextCatalog.getString("Kanban {{ label }} successfully deleted", {
            label: escaper.html(SharedPropertiesService.getKanban().label),