CVE-2022-3035 (PHP, published 2022-08-29T20:15Z)
Description: value: Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.0.11.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/snipe/snipe-it
Files changed:
app/Helpers/Helper.php
app/Models/Accessory.php
app/Models/Asset.php
app/Models/Category.php
app/Models/Consumable.php
app/Models/License.php
app/Models/Setting.php
app/Presenters/AssetModelPresenter.php
resources/views/auth/login.blade.php
resources/views/dashboard.blade.php
resources/views/layouts/default.blade.php
Commit message: Set safeMode to true and use helper for all parsedown

Signed-off-by: snipe <snipe@snipe.net>


Vulnerable code:
    public static function parseEscapedMarkedown($str)
            return $Parsedown->text(e($str));
        $Parsedown = new \Parsedown();
            return $Parsedown->text(e($this->category->eula_text));
            return $Parsedown->text(e(Setting::getSettings()->default_eula_text));
            return null;
        $Parsedown = new \Parsedown();
        
                return $Parsedown->text(e($this->model->category->eula_text));
                return $Parsedown->text(e(Setting::getSettings()->default_eula_text));
        $Parsedown = new \Parsedown();
            return $Parsedown->text(e($this->eula_text));
            return $Parsedown->text(e(Setting::getSettings()->default_eula_text));
        $Parsedown = new \Parsedown();

            return $Parsedown->text(e($this->category->eula_text));
            return $Parsedown->text(e(Setting::getSettings()->default_eula_text));
        $Parsedown = new \Parsedown();
            return $Parsedown->text(e($this->category->eula_text));
            return $Parsedown->text(e(Setting::getSettings()->default_eula_text));
use Parsedown;

            $parsedown = new Parsedown();

            return $parsedown->text(e(self::getSettings()->default_eula_text));
        $Parsedown = new \Parsedown();

            return $Parsedown->text($this->model->note);
                                            {!!  Parsedown::instance()->text(e($snipeSettings->login_note))  !!}
                        {!!  Parsedown::instance()->text(e($snipeSettings->dashboard_message))  !!}
                  {!!  Parsedown::instance()->text(e($snipeSettings->footer_text))  !!}

Fixed code:
    public static function parseEscapedMarkedown($str = null)
        $Parsedown->setSafeMode(true);
            return $Parsedown->text($str);
use App\Helpers\Helper;
            return Helper::parseEscapedMarkedown($this->category->eula_text);
            return Helper::parseEscapedMarkedown(Setting::getSettings()->default_eula_text);
        return null;
use App\Helpers\Helper;

                return Helper::parseEscapedMarkedown($this->model->category->eula_text);
                return Helper::parseEscapedMarkedown(Setting::getSettings()->default_eula_text);
use App\Helpers\Helper;
            return Helper::parseEscapedMarkedown($this->eula_text);
            return Helper::parseEscapedMarkedown(Setting::getSettings()->default_eula_text);
use App\Helpers\Helper;
            return  Helper::parseEscapedMarkedown($this->category->eula_text);
            return  Helper::parseEscapedMarkedown(Setting::getSettings()->default_eula_text);
use App\Helpers\Helper;
            return Helper::parseEscapedMarkedown($this->category->eula_text);
            return Helper::parseEscapedMarkedown(Setting::getSettings()->default_eula_text);
use App\Helpers\Helper;

            return Helper::parseEscapedMarkedown(self::getSettings()->default_eula_text);
use App\Helpers\Helper;

            return Helper::parseEscapedMarkedown($this->model->note);
                                            {!!  Helper::parseEscapedMarkedown($snipeSettings->login_note)  !!}
                        {!!  Helper::parseEscapedMarkedown($snipeSettings->dashboard_message)  !!}
                  {!!  Helper::parseEscapedMarkedown($snipeSettings->footer_text)  !!}