CVE-2023-36666 (PHP, published 2023-06-25T22:15Z)
Description: value: INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/inex/IXP-Manager
Files changed:
resources/views/console-server-connection/list-preamble.foil.php
resources/views/console-server-connection/page-header-preamble.foil.php
resources/views/contact/edit-form.foil.php
resources/views/contact/page-header-preamble.foil.php
resources/views/customer/overview.foil.php
resources/views/customer/tag/cust.foil.php
resources/views/log/view.foil.php
Commit message: [BF] Fix a number of XSS issues

Thanks to the GRNET IT Security Team for responsibly disclosing these issues.


Vulnerable code:
            Ports for Console Server: <?= $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ?><br><br>
                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] : "All Console Server Ports" ?> <span class="caret"></span>
                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $css[ 'name' ] ?></a>
                                                <?= $role[ 'name' ] ?>
                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name']  : "All Roles" ?>
                        <?= $role[ 'name' ] ?>
                                <?= $tag->display_as ?>
                                            <?= $tag->display_as . " (" . $tag->tag . ")" ?>
                                      <?= $tag->description ?>
                                                        <?= $key ?>
                                                        <?= $new[ $key ] ?>
                                                            <?= $old[ $key ] ?>
                                                            <?= json_encode($old[ $key ], JSON_THROW_ON_ERROR) ?>

Fixed code:
            Ports for Console Server: <?= $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) ?><br><br>
                <?= isset( $t->data[ 'params'][ "cs" ] ) ? $t->ee( $t->data[ 'params'][ "css" ][$t->data[ 'params'][ "cs" ] ][ 'name' ] ) : "All Console Server Ports" ?> <span class="caret"></span>
                    <a class="dropdown-item <?= isset( $t->data[ 'params'][ "cs" ] ) && $t->data[ 'params'][ "cs" ] === $css[ 'id' ] ? 'active' : '' ?>" href="<?= route( "console-server-connection@listPort", [ "cs" => $css[ 'id' ] ] ) ?>"><?= $t->ee( $css[ 'name' ] ) ?></a>
                                                <?= $t->ee( $role[ 'name' ] ) ?>
                <?= isset( $t->data[ 'params'][ "role" ] ) ? $t->ee( $t->data[ 'params'][ "roles" ][ $t->data[ 'params'][ "role" ] ][ 'name'] ) : "All Roles" ?>
                        <?= $t->ee( $role[ 'name' ] ) ?>
                                <?= $t->ee( $tag->display_as ) ?>
                                            <?= $t->ee( $tag->display_as ) . " (" . $t->ee( $tag->tag ) . ")" ?>
                                      <?= $t->ee( $tag->description ) ?>
                                                        <?= $t->ee( $key ) ?>
                                                        <?= $t->ee( $new[ $key ] ) ?>
                                                            <?= $t->ee( $old[ $key ] ) ?>
                                                            <?= json_encode($old[ $key ], JSON_HEX_QUOT|JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_THROW_ON_ERROR) ?>