CVE-2022-0838 (JavaScript, published 2022-03-04T08:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.10.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hestiacp/hestiacp
Files changed:
web/js/app.js
web/js/pages/add_db.js
web/js/pages/add_dns_rec.js
web/js/pages/add_mail_acc.js
web/js/pages/add_web.js
web/js/pages/edit_db.js
web/js/pages/edit_dns_rec.js
web/js/pages/edit_mail_acc.js
web/templates/pages/add_db.html
web/templates/pages/edit_db.html
Commit message: replace html() with text

+ 2 small problems on add / edit database page


Vulnerable code:

        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
    if (pass=="") div.find('#v_password').html(' ');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html('STARTTLS');
                $('#td_smtp_port').html('587');
                $('#td_smtp_encryption').html('STARTTLS');
                $('#td_imap_port').html('993');
                $('#td_imap_encryption').html('SSL / TLS');
                $('#td_smtp_port').html('465');
                $('#td_smtp_encryption').html('SSL / TLS');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html(opt.attr('no_encryption'));
                $('#td_smtp_port').html('25');
                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
    $('.custom_docroot_hint').html(prepath+domain+'/public_html/'+folder);
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.v-ftp-path-hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
        $(elm).parent().find('.hint').html('');
    if (pass=="") div.find('#v_password').html(' ');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html('STARTTLS');
                $('#td_smtp_port').html('587');
                $('#td_smtp_encryption').html('STARTTLS');
                $('#td_imap_port').html('993');
                $('#td_imap_encryption').html('SSL / TLS');
                $('#td_smtp_port').html('465');
                $('#td_smtp_encryption').html('SSL / TLS');
                $('#td_imap_hostname').html(opt.attr('domain'));
                $('#td_smtp_hostname').html(opt.attr('domain'));
                $('#td_imap_port').html('143');
                $('#td_imap_encryption').html(opt.attr('no_encryption'));
                $('#td_smtp_port').html('25');
                $('#td_smtp_encryption').html(opt.attr('no_encryption'));
									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user.'_</b>'); ?>
GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>";
    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>";
    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>";

Fixed code:
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
    if (pass=="") div.find('#v_password').text(' ');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text('STARTTLS');
                $('#td_smtp_port').text('587');
                $('#td_smtp_encryption').text('STARTTLS');
                $('#td_imap_port').text('993');
                $('#td_imap_encryption').text('SSL / TLS');
                $('#td_smtp_port').text('465');
                $('#td_smtp_encryption').text('SSL / TLS');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text(opt.attr('no_encryption'));
                $('#td_smtp_port').text('25');
                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
    $('.custom_docroot_hint').text(prepath+domain+'/public_html/'+folder);
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.v-ftp-path-hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
        $(elm).parent().find('.hint').text('');
    if (pass=="") div.find('#v_password').text(' ');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text('STARTTLS');
                $('#td_smtp_port').text('587');
                $('#td_smtp_encryption').text('STARTTLS');
                $('#td_imap_port').text('993');
                $('#td_imap_encryption').text('SSL / TLS');
                $('#td_smtp_port').text('465');
                $('#td_smtp_encryption').text('SSL / TLS');
                $('#td_imap_hostname').text(opt.attr('domain'));
                $('#td_smtp_hostname').text(opt.attr('domain'));
                $('#td_imap_port').text('143');
                $('#td_imap_encryption').text(opt.attr('no_encryption'));
                $('#td_smtp_port').text('25');
                $('#td_smtp_encryption').text(opt.attr('no_encryption'));
									<?=sprintf(_('Prefix %s will be automatically added to database name and database user'),'<b>'.$user_plain.'_</b>'); ?>
GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
GLOBAL.DB_DBNAME_PREFIX = "<?=$user_plain;?>_";
    GLOBAL.DB_USER_PREFIX = "<?=$user_plain;?>_";
    GLOBAL.DB_DBNAME_PREFIX =  "<?=$user_plain;?>_";