CVE-2019-19617: Insufficient Information (NVD-CWE-noinfo)
value: phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2019-12-06T03:15Z
Repository: https://github.com/phpmyadmin/phpmyadmin
Language: PHP
Files changed: libraries/classes/Display/GitRevision.php, libraries/classes/Footer.php
Commit date: 2019-10-18 18:03:53 -0300
Commit message: Escape Git information on the index page

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

Diff: diff --git a/libraries/classes/Display/GitRevision.php b/libraries/classes/Display/GitRevision.php
index 8b350e8caf9cd..4cbd0cf48dc1b 100644
--- a/libraries/classes/Display/GitRevision.php
+++ b/libraries/classes/Display/GitRevision.php
@@ -41,31 +41,36 @@ public static function display()
             0,
             7
         );
         $commit_hash = '<strong title="'
             . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_MESSAGE'))
-            . '">' . $commit_hash . '</strong>';
+            . '">' . htmlspecialchars($commit_hash) . '</strong>';
         if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTECOMMIT')) {
             $commit_hash = '<a href="'
                 . Core::linkURL(
                     'https://github.com/phpmyadmin/phpmyadmin/commit/'
-                    . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
+                    . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH'))
                 )
                 . '" rel="noopener noreferrer" target="_blank">' . $commit_hash . '</a>';
         }
 
         $branch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH');
-        if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH')) {
+        $isRemoteBranch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH');
+        if ($isRemoteBranch) {
             $branch = '<a href="'
                 . Core::linkURL(
                     'https://github.com/phpmyadmin/phpmyadmin/tree/'
                     . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH')
                 )
-                . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
+                . '" rel="noopener noreferrer" target="_blank">' . htmlspecialchars($branch) . '</a>';
         }
         if ($branch !== false) {
-            $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);
+            $branch = sprintf(
+                __('%1$s from %2$s branch'),
+                $commit_hash,
+                $isRemoteBranch ? $branch : htmlspecialchars($branch)
+            );
         } else {
             $branch = $commit_hash . ' (' . __('no branch') . ')';
         }
 
         $committer = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITTER');
diff --git a/libraries/classes/Footer.php b/libraries/classes/Footer.php
index 7ef6a63d57ed3..5398eed898b96 100644
--- a/libraries/classes/Footer.php
+++ b/libraries/classes/Footer.php
@@ -81,14 +81,14 @@ private function _getDemoMessage()
         $message = '<a href="/">' . __('phpMyAdmin Demo Server') . '</a>: ';
         if (@file_exists('./revision-info.php')) {
             include './revision-info.php';
             $message .= sprintf(
                 __('Currently running Git revision %1$s from the %2$s branch.'),
-                '<a target="_blank" rel="noopener noreferrer" href="' . $repobase . $fullrevision . '">'
-                . $revision . '</a>',
-                '<a target="_blank" rel="noopener noreferrer" href="' . $repobranchbase . $branch . '">'
-                . $branch . '</a>'
+                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobase . $fullrevision) . '">'
+                . htmlspecialchars($revision) . '</a>',
+                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobranchbase . $branch) . '">'
+                . htmlspecialchars($branch) . '</a>'
             );
         } else {
             $message .= __('Git information missing!');
         }
 

Vulnerable code:             . '">' . $commit_hash . '</strong>';
                    . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
        if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH')) {
                . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
            $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);
                '<a target="_blank" rel="noopener noreferrer" href="' . $repobase . $fullrevision . '">'
                . $revision . '</a>',
                '<a target="_blank" rel="noopener noreferrer" href="' . $repobranchbase . $branch . '">'
                . $branch . '</a>'
Fixed code:             . '">' . htmlspecialchars($commit_hash) . '</strong>';
                    . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH'))
        $isRemoteBranch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH');
        if ($isRemoteBranch) {
                . '" rel="noopener noreferrer" target="_blank">' . htmlspecialchars($branch) . '</a>';
            $branch = sprintf(
                __('%1$s from %2$s branch'),
                $commit_hash,
                $isRemoteBranch ? $branch : htmlspecialchars($branch)
            );
                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobase . $fullrevision) . '">'
                . htmlspecialchars($revision) . '</a>',
                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobranchbase . $branch) . '">'
                . htmlspecialchars($branch) . '</a>'