CVE-2023-37901 (HTML, published 2023-07-21T19:15Z)
Description: value: Indico is an open source a general-purpose, web based event management tool. There is a Cross-Site-Scripting vulnerability in confirmation prompts commonly used when deleting content from Indico. Exploitation requires someone with at least submission privileges (such as a speaker) and then someone else to attempt to delete this content. Considering that event organizers may want to delete suspicious-looking content when spotting it, there is a non-negligible risk of such an attack to succeed. The risk of this could be further increased when combined with some some social engineering pointing the victim towards this content. Users need to update to Indico 3.2.6 as soon as possible. See the docs for instructions on how to update. Users who cannot upgrade should only let trustworthy users manage categories, create events or upload materials ("submission" privileges on a contribution/event). This should already be the case in a properly-configured setup when it comes to category/event management. Note that a conference doing a Call for Abstracts actively invites external speakers (who the organizers may not know and thus cannot fully trust) to submit content, hence the need to update to a a fixed version ASAP in particular when using such workflows.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/indico/indico
Files changed:
CHANGES.rst
indico/modules/attachments/templates/_attachments.html
indico/modules/categories/templates/management/base.html
indico/modules/events/abstracts/templates/reviewing/public.html
indico/modules/events/layout/templates/_menu.html
indico/modules/events/management/templates/_action_menu.html
indico/modules/events/static/templates/static_sites.html
indico/modules/events/surveys/templates/management/survey.html
indico/modules/oauth/templates/user_apps.html
indico/modules/oauth/templates/user_tokens.html
indico/modules/users/templates/personal_data.html
indico/web/client/js/jquery/utils/misc.js
Commit message: Fix XSS in confirmation prompts

Also update some confirmation prompts to not use HTML in the message as
this is no longer supported.


Vulnerable code:
                       Are you sure you want to remove &quot;{{ name }}&quot;?<br>
                       Are you sure you want to remove &quot;{{ name }}&quot;?<br>
        {% trans category=category.title %}Do you really want to delete the category "{{ category }}"?{% endtrans %}
       data-confirm="{{ confirmation_message|forceescape }}"
                                <br>
                                <br>
                                {%- trans name='&quot;%s&quot;'|format(entry.localized_title) -%}
        Changing the event type to <strong>{{ type }}</strong> will change the look of the event page
                        data-confirm="{% trans %}Are you sure you want to build an offline copy of this event?<br>Beware that it is a heavy operation, especially for large events, and it might take some time to finish.{% endtrans %}">
                    <br><br>
                    {% trans %}Note: Authenticated users will not be able to submit an anonymous survey again even if you delete their submission.{% endtrans %}
                                    data-confirm="{% trans app_name=auth.application.name %}{{ app_name }} will no longer have access to your Indico data.<br>
                                                <br><br>
                                                <strong>
                                                </strong>
                                        data-confirm="{% trans %}This user will no longer have access to Indico.<br>
                                    data-confirm="{% trans %}This user will regain access to Indico.<br>
    message = $('<div>', {width: 400, html: message});

Fixed code:
Security fixes
^^^^^^^^^^^^^^

- Fix an XSS vulnerability in various confirmation prompts commonly used when deleting
  things. Exploitation requires someone with at least submission privileges (such as a
  speaker) and then rely on someone else to attempt to delete this content. However,
  considering that event organizers may indeed delete suspicious-looking content when
  encountering it, there is a non-negligible risk of such an attack to succeed. Because
  of this it is strongly recommended to upgrade as soon as possible (:pr:`5862`,
  :cve:`CVE-2023-37901`)

                       Are you sure you want to remove &quot;{{ name }}&quot;?
                       Are you sure you want to remove &quot;{{ name }}&quot;?
        {% trans category=category.title %}
            Do you really want to delete the category &quot;{{ category }}&quot;?
        {% endtrans %}
       data-confirm="{{ confirmation_message }}"
                                {%- trans name='"%s"'|format(entry.localized_title) -%}
        Changing the event type to {{ type }} will change the look of the event page
                        data-confirm="{% trans %}Are you sure you want to build an offline copy of this event? Beware that it is a heavy operation, especially for large events, and it might take some time to finish.{% endtrans %}">
                    {% trans %}
                        Note: Authenticated users will not be able to submit an anonymous survey again
                        even if you delete their submission.
                    {% endtrans %}
                                    data-confirm="{% trans app_name=auth.application.name %}{{ app_name }} will no longer have access to your Indico data.
                                        data-confirm="{% trans %}This user will no longer have access to Indico.
                                    data-confirm="{% trans %}This user will regain access to Indico.
    message = $('<div>', {width: 400, text: message});