CVE-2023-2615 (PHP, published 2023-05-10T06:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/pimcore/pimcore
Files changed:
bundles/AdminBundle/Resources/public/js/pimcore/settings/properties/predefined.js
models/Property/Predefined.php
Commit message: [Security] Fix xss in predefined properties panel (#14943)

* fixed xss in predefined properties panel

* used global helper function for htmlEncode `pimcore.helpers.htmlEncodeTextField`

* added `SecurityHelper::convertHtmlSpecialChars`

* Update predefined.js

prevented xss

Vulnerable code:
            ['id',

            {text: t("name"), flex: 100, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({})},
            {text: t("description"), sortable: true, dataIndex: 'description', editor: new Ext.form.TextArea({}),
            {text: t("key"), flex: 50, sortable: true, dataIndex: 'key', editor: new Ext.form.TextField({})},
            {text: t("value"), flex: 50, sortable: true, dataIndex: 'data', editor: new Ext.form.TextField({})},
            {text: t("configuration"), flex: 50, sortable: false, dataIndex: 'config', editor: new Ext.form.TextField({})},
                        pimcore.helpers.deleteConfirm(t('predefined_properties'),
                            Ext.util.Format.htmlEncode(data.data.name),
                            grid.getStore().removeAt(rowIndex);
                        }.bind(this));
        $this->key = $key;
        $this->name = $name;
        $this->data = $data;
        $this->config = $config;
        $this->description = $description;

Fixed code:
            [
                'id',
            {text: t("name"), flex: 100, sortable: true, dataIndex: 'name', editor: new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
            {text: t("description"), sortable: true, dataIndex: 'description', editor: new Ext.form.TextArea({listeners: {'change': pimcore.helpers.htmlEncodeTextField}}),
            {text: t("key"), flex: 50, sortable: true, dataIndex: 'key', editor: new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
            {text: t("value"), flex: 50, sortable: true, dataIndex: 'data', editor: new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
            {text: t("configuration"), flex: 50, sortable: false, dataIndex: 'config', editor: new Ext.form.TextField({listeners: {'change': pimcore.helpers.htmlEncodeTextField}})},
                        const decodedName = Ext.util.Format.htmlDecode(data.data.name);
                        
                        pimcore.helpers.deleteConfirm(
                            t('predefined_properties'),
                            Ext.util.Format.htmlEncode(decodedName),
                                grid.getStore().removeAt(rowIndex);
                            }.bind(this)
                        );
use Pimcore\Security\SecurityHelper;
        $this->key = SecurityHelper::convertHtmlSpecialChars($key);
        $this->name = SecurityHelper::convertHtmlSpecialChars($name);
        $this->data = SecurityHelper::convertHtmlSpecialChars($data);
        $this->config = SecurityHelper::convertHtmlSpecialChars($config);
        $this->description = SecurityHelper::convertHtmlSpecialChars($description);