CVE-2020-28954 (Other, published 2020-11-19T22:15Z)
Description: value: web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/bigbluebutton/bigbluebutton
Files changed:
bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy
Commit message: Sanitize all received parameters


Vulnerable code:
      params.fullName = StringUtils.strip(params.fullName);
      // remove control characters ( sanitize )
      params.fullName = params.fullName.replaceAll("\\p{Cntrl}", "");


Fixed code:
    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }


    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    String API_CALL = 'enter'
    log.debug CONTROLLER_NAME + "#${API_CALL}"

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    String API_CALL = 'stuns'
    log.debug CONTROLLER_NAME + "#${API_CALL}"

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    String API_CALL = 'signOut'
    log.debug CONTROLLER_NAME + "#${API_CALL}"

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }
    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

    //sanitizeInput
    params.each {
      key, value -> params[key] = sanitizeInput(value)
    }

  private def sanitizeInput (input) {
    if(input == null)
      return

    if(!("java.lang.String".equals(input.getClass().getName())))
      return input

    StringUtils.strip(input.replaceAll("\\p{Cntrl}", ""));
  }