CVE-2023-3009 (PHP, published 2023-05-31T13:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nilsteampassnet/teampass
Files changed:
includes/js/functions.js
pages/items.js.php
Commit message: 3.0.9

Vulnerability fix (#3741)


Vulnerable code:
            if ($('#form-item-label').val() === '') {
            } else if ($('#form-item-tags').val() !== '' &&
                reg.test($('#form-item-tags').val())
                    'description': $('#form-item-description').summernote('code') !== "<p><br></p>" ? DOMPurify.sanitize($('#form-item-description').summernote('code'), {USE_PROFILES: {html: true, svg: false, svgFilters: false}}) : '',
                    'email': DOMPurify.sanitize($('#form-item-email').val()),
                    'label': DOMPurify.sanitize($('#form-item-label').val(), {USE_PROFILES: {html:false, svg: false, svgFilters: false}}),
                    'tags': DOMPurify.sanitize($('#form-item-tags').val()),
                    'url': DOMPurify.sanitize($('#form-item-url').val()),
                    'fa_icon': DOMPurify.sanitize($('#form-item-icon').val()),

Fixed code:
}

function fieldSanitizeStep1(
    field,
    bHtml=true,
    bSvg=true,
    bSvgFilters=true,
    text=''
)
{
    if (field === undefined ||field === '') {
        return false;
    }
    let string = '';
    text = (text === '') ? $(field).val() : text;
    
    // Purify string
    string = DOMPurify.sanitize(
        text
            .replaceAll('&lt;', '<')
            .replaceAll('&gt;', '>'),
        {USE_PROFILES: {html:bHtml, svg:bSvg, svgFilters: bSvgFilters}}
    );
    
    // Clear field if string is empty and warn user
    if (string === '' && text !== '') {
        $(field).val('');
        return false;
    }

    return string;
        

            // Sanitize text fields
            let formLabel = fieldSanitizeStep1('#form-item-label', false, false, false),
                formDescription = $('#form-item-description').summernote('code') !== "<p><br></p>" ? fieldSanitizeStep1('#form-item-description', true, false, false, $('#form-item-description').summernote('code')) : '',
                formEmail = fieldSanitizeStep1('#form-item-email'),
                formTags = fieldSanitizeStep1('#form-item-tags'),
                formUrl = fieldSanitizeStep1('#form-item-url'),
                formIcon = fieldSanitizeStep1('#form-item-icon');
            if (formLabel === false || formDescription === false || formEmail === false || formTags === false || formUrl === false || formIcon === false) {
                // Label is empty
                toastr.remove();
                toastr.warning(
                    'XSS attempt detected. Field has been emptied.',
                    'Error', {
                        timeOut: 5000,
                        progressBar: true
                    }
                );
                return false;
            }
            
            if (formLabel === '') {
            } else if (formTags !== '' &&
                reg.test(formTags)
                    
                    'description': formDescription,
                    'email': formEmail,
                    'label': formLabel,
                    'tags': formTags,
                    'url': formUrl,
                    'fa_icon': formIcon,