CVE-2022-4721 (HTML, published 2022-12-27T15:15Z)
Description: value: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-75 \u2014 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
The product does not adequately filter user-controlled input for special elements with control implications.
Repository: https://github.com/ikus060/rdiffweb
Files changed:
rdiffweb/core/notification.py
rdiffweb/core/tests/test_notification.py
rdiffweb/templates/email_access_token_added.html
rdiffweb/templates/email_changed.html
rdiffweb/templates/email_mfa.html
rdiffweb/templates/email_notification.html
rdiffweb/templates/email_password_changed.html
rdiffweb/templates/email_verification_code.html
Commit message: Disable automatic hyperlink in email template


Vulnerable code:
            "access_token_added.html", **{"header_name": self.app.cfg.header_name, 'user': userobj, 'name': name}
            "password_changed.html", **{"header_name": self.app.cfg.header_name, 'user': userobj}
            message="<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      <li>testcases</li>\n    </ul>\n    <p>\n      If you don't want to be notify about this. You need to review your\n      user preferences.\n    </p>\n  </body>\n</html>",
            message="<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      <li>broker-repo</li>\n    </ul>\n    <p>\n      If you don't want to be notify about this. You need to review your\n      user preferences.\n    </p>\n  </body>\n</html>",
            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the email address associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
            message='<html>\n  <head></head>\n  <body>\n    Hey admin,\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
<html>
  <head></head>
  <body>
    {% trans username=user.username %}Hey {{ username }},{% endtrans %}
    <p>{% trans %}A new access token, named "{{ name }}", has been created.{% endtrans %}</p>
    <p>
      {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}
    </p>
  </body>
</html>
    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
    <p>{% trans %}You recently changed the email address associated with your {{ header_name }} account.{% endtrans %}</p>
    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}
      {% for r in repos %}<li>{{ r.display_name }}</li>{% endfor %}
    <p>
      {% trans %}If you don't want to be notify about this. You need to review your
      user preferences.{% endtrans %}
    </p>
    {% trans username=user.username %}Hey {{ username }},{% endtrans %}
    {% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}

Fixed code:
            "email_access_token_added.html", **{"header_name": self.app.cfg.header_name, 'user': userobj, 'name': name}
            "email_password_changed.html", **{"header_name": self.app.cfg.header_name, 'user': userobj}
            message="<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      \n        <li>\n          <a>testcases</a>\n        </li>\n      \n    </ul>\n    <p>If you don't want to be notify about this. You need to review your user preferences.</p>\n  </body>\n</html>",
            message="<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      You are receiving this email to notify you about your backups. The\n      following repositories are inactive for some time. We invite you to have a look\n      at your last backup schedule.\n    </p>\n    <ul>\n      \n        <li>\n          <a>broker-repo</a>\n        </li>\n      \n    </ul>\n    <p>If you don't want to be notify about this. You need to review your user preferences.</p>\n  </body>\n</html>",
            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>\n      <a>You recently changed the email address associated with your Rdiffweb account.</a>\n    </p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
            message='<html>\n  <head></head>\n  <body>\n    <p>\n      <a>Hey admin,</a>\n    </p>\n    <p>You recently changed the password associated with your Rdiffweb account.</p>\n    <p>\n      If you did not make this change and believe your account has been compromised, please contact your administrator.\n    </p>\n  </body>\n</html>',
<html>
  <head></head>
  <body>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>
    <p>
      <a>{% trans %}A new access token, named "{{ name }}", has been created.{% endtrans %}</a>
    </p>
    <p>
      {% trans %}If you did not make this change and believe your account has been compromised, please contact your administrator.{% endtrans %}
    </p>
  </body>
</html>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>
    <p>
      <a>{% trans %}You recently changed the email address associated with your {{ header_name }} account.{% endtrans %}</a>
    </p>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>
      {% for r in repos %}
        <li>
          <a>{{ r.display_name }}</a>
        </li>
      {% endfor %}
    <p>{% trans %}If you don't want to be notify about this. You need to review your user preferences.{% endtrans %}</p>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>
    <p>
      <a>{% trans username=(user.fullname or user.username) %}Hey {{ username }},{% endtrans %}</a>
    </p>