CVE-2022-1504 (PHP, published 2022-04-27T11:15Z)
Description: value: XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/microweber/microweber
Files changed:
src/MicroweberPackages/App/Http/Controllers/ApiController.php
src/MicroweberPackages/App/Http/Controllers/FrontendController.php
src/MicroweberPackages/Comment/Models/CommentsCrud.php
src/MicroweberPackages/Content/Models/ModelFilters/Traits/FilterByKeywordTrait.php
src/MicroweberPackages/Helper/HTMLClean.php
src/MicroweberPackages/Helper/XSSClean.php
src/MicroweberPackages/Helper/tests/SecurityTest.php
Commit message: update


Vulnerable code:
use voku\helper\AntiXSS;
            $antixss = new AntiXSS();
                $v = $antixss->xss_clean($v);
                    $k = $antixss->xss_clean($k);
use voku\helper\AntiXSS;
use voku\helper\AntiXSS;
use voku\helper\AntiXSS;
        $antixss = new AntiXSS();
            $keyword = $antixss->xss_clean($keyword);
        $antiXss = new \voku\helper\AntiXSS();
        $html = $antiXss->xss_clean($html);
       $this->assertEquals($string, $content);
        $string = '<img src="'.site_url().'test.jpg" />';
        $this->assertEquals('<img src="'.site_url().'test.jpg" alt="test.jpg" />', $content);
        $zip->open(__DIR__.'/misc/xss-test-files.zip');

Fixed code:
use MicroweberPackages\Helper\XSSClean;

            $xssClean = new XSSClean();

                if(is_array($v)) {
                    $v = $xssClean->cleanArray($v);
                } else {
                    $v = $xssClean->clean($v);
                }

                    $k = $xssClean->clean($k);
            var_dump($request_data);
            exit;
use MicroweberPackages\Helper\XSSClean;

        $xssClean = new XSSClean();

            $keyword = $xssClean->clean($keyword);


        $xssClean = new XSSClean();
        $html = $xssClean->clean($html);
<?php

namespace MicroweberPackages\Helper;

use voku\helper\AntiXSS;

class XSSClean
{


    public function cleanArray($array): array
    {

        if (is_array($array)) {

            $cleanedArray = [];
            foreach ($array as $key => $value) {
                if (is_string($key)) {
                    $key = $this->clean($key);
                }

                if (is_array($value)) {
                    $cleanedArray[$key] = $this->cleanArray($value);
                } else {
                    $cleanedArray[$key] = $this->clean($value);
                }
            }

            return $cleanedArray;
        }
    }

     public function clean($html): string
    {
 // from https://portswigger.net/web-security/cross-site-scripting/cheat-sheet#ontransitionend
        $cleanStrings = [
            'ontransitionstart',
           // 'onwebkitanimationend',
            'onwebkitanimationiteration',
            'onwebkitanimationstart',
            'onwebkittransitionend',
            'ontransitionrun',
            'onloadedmetadata',
            'ondurationchange',
            'oncanplaythrough',
            'oncuechange',
            'onbounce',
            'onbegin',
            'onbeforeunload',
            'onbeforescriptexecute',
            'onbeforeprint',
            'onanimationstart',
            'onanimationiteration',
            'onanimationend',
            'onanimationcancel',
            'onafterscriptexecute',
            'onfocusin',
            'onhashchange',
            'onload',
            'onunload',
            'onloadend',
            'onloadstart',
            'onmessage',
            'onpageshow',
            'onloadedmetadata',
            'onloadeddata',
            'onplay',
            'onplaying',
            'onpopstate',
            'onprogress',
            'onrepeat',
            'onresize',
            'onscroll',
            'onstart',
            'ontimeupdate',
            'ontoggle',
            'ontransitionend',
            'ontransitioncancel',
            'ontransitionrun',
            'ontransitionstart',
            'onafterprint',
            'onauxclick',
            'onbeforecopy',
            'onbeforecut',
            'onblur',
            'onchange',
            'onclick',
            'onclose',
            'oncontextmenu',
            'oncopy',
            'oncut',
            'ondblclick',
            'ondrag',
            'ondragend',
            'ondragenter',
            'ondragleave',
            'ondragover',
            'ondragstart',
            'ondrop',
            'onfocusout',
            'onfullscreenchange',
            'oninput',
            'oninvalid',
            'onkeydown',
            'onkeypress',
            'onkeyup',
            'onmousedown',
            'onmouseenter',
            'onmouseleave',
            'onmousemove',
            'onmouseout',
            'onmouseover',
            'onmouseup',
            'onmousewheel',
            'onmozfullscreenchange',
            'onpagehide',
            'onpaste',
            'onpause',
            'onpointerdown',
            'onpointerenter',
            'onpointerleave',
            'onpointermove',
            'onpointerout',
            'onpointerover',
            'onpointerrawupdate',
            'onpointerup',
            'onreset',
            'onsearch',
            'onseeked',
            'onseeking',
            'onselect',
            'onselectionchange',
            'onselectstart',
            'onshow',
            'onsubmit',
            'ontouchend',
            'ontouchmove',
            'ontouchstart',
            'onvolumechange',
            'onwheel',
            'onunhandledrejection'
        ];

        $antiXss = new AntiXSS();
        $antiXss->addEvilHtmlTags($cleanStrings);
        $antiXss->addEvilAttributes($cleanStrings);
        $antiXss->addNeverAllowedOnEventsAfterwards($cleanStrings);

        $html = $antiXss->xss_clean($html);


        return $html;
    }

}

use MicroweberPackages\Helper\XSSClean;

        $this->assertEquals($string, $content);
        $string = '<img src="' . site_url() . 'test.jpg" />';
        $this->assertEquals('<img src="' . site_url() . 'test.jpg" alt="test.jpg" />', $content);
        $zip->open(__DIR__ . '/misc/xss-test-files.zip');
    public function testXSSCleanArrtibutesNewEvents()
    {
        $xssClean = new XSSClean();
        $str = "class='x module module-'ontransitionrun=alert(1) '";
        $clean = $xssClean->clean($str);
        $this->assertEquals("class='x module module-'=alert&#40;1&#41; '", $clean);

    }