CVE-2023-4347 (PHP, published 2023-08-15T02:15Z)
Description: value: Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/librenms/librenms
Files changed:
includes/html/pages/apps/ntp.inc.php
includes/html/pages/device/port/realtime.inc.php
includes/html/pages/health/mempool.inc.php
includes/html/pages/health/processor.inc.php
includes/html/pages/health/sensors.inc.php
includes/html/pages/health/storage.inc.php
includes/html/pages/health/toner.inc.php
includes/html/pages/outages.inc.php
includes/html/pages/ports/list.inc.php
includes/html/pages/search/fdb.inc.php
includes/html/pages/syslog.inc.php
includes/html/pages/wireless/sensors.inc.php
Commit message: Fix unsanitized input injection (#15184)

Search for and sanitize import that is output to html.
Spurred by report from [Hakiduck](https://huntr.dev/users/mike993/)

Vulnerable code:
                view: '<?php echo $vars['view']; ?>',
                graph: '<?php echo $vars['graph']; ?>',
<object data="graph-realtime.php?type=bits&id=<?php echo $port['port_id'] . '&interval=' . $vars['interval']; ?>" type="image/svg+xml" width="1000" height="400">
<param name="src" value="graph.php?type=bits&id=<?php echo $port['port_id'] . '&interval=' . $vars['interval']; ?>" />
                view: '<?php echo $vars['view']; ?>'
                view: '<?php echo $vars['view']; ?>'
                view: '<?php echo $vars['view']; ?>',
                graph_type: '<?php echo $graph_type; ?>',
                unit: '<?php echo $unit; ?>',
                class: '<?php echo $class; ?>'
                view: '<?php echo $vars['view']; ?>'
                view: '<?php echo $vars['view']; ?>'
        '<input name="from" type="text" class="form-control" id="dtpickerfrom" maxlength="16" value="<?php echo $vars['from']; ?>" placeholder="From" data-date-format="YYYY-MM-DD HH:mm">' +
        '&nbsp;&nbsp;<input name="to" type="text" class="form-control" id="dtpickerto" maxlength="16" value="<?php echo $vars['to']; ?>" placeholder="To" data-date-format="YYYY-MM-DD HH:mm">' +
            device_id: '<?php echo $vars['device_id'] ?? ''; ?>',
            state: '<?php echo $vars['state'] ?? ''; ?>',
            ifSpeed: '<?php echo $vars['ifSpeed'] ?? ''; ?>',
            ifType: '<?php echo $vars['ifType'] ?? ''; ?>',
            port_descr_type: '<?php echo $vars['port_descr_type'] ?? ''; ?>',
            ifAlias: '<?php echo $vars['ifAlias'] ?? ''; ?>',
            location: '<?php echo $vars['location'] ?? ''; ?>',
            disabled: '<?php echo $vars['disabled'] ?? ''; ?>',
            ignore: '<?php echo $vars['ignore'] ?? ''; ?>',
            deleted: '<?php echo $vars['deleted'] ?? ''; ?>',
            errors: '<?php echo $vars['errors'] ?? ''; ?>',
            group: '<?php echo $vars['group'] ?? ''; ?>',
            devicegroup: '<?php echo $vars['devicegroup'] ?? ''; ?>',
            device_id: '<?php echo $vars['device_id']; ?>',
            searchby: '<?php echo $vars['searchby']; ?>',
            searchPhrase: '<?php echo $vars['searchPhrase']; ?>',
        '<input name="from" type="text" class="form-control" id="dtpickerfrom" maxlength="16" value="<?php echo $vars['from'] ?? ''; ?>" placeholder="From" data-date-format="YYYY-MM-DD HH:mm">' +
        '&nbsp;&nbsp;<input name="to" type="text" class="form-control" id="dtpickerto" maxlength="16" value="<?php echo $vars['to'] ?? ''; ?>" placeholder="To" data-date-format="YYYY-MM-DD HH:mm">' +
                view:       '<?php echo $vars['view']; ?>',
                graph_type: '<?php echo $graph_type; ?>',
                unit:       '<?php echo $unit; ?>',
                class:      '<?php echo $class; ?>'

Fixed code:
                view: '<?php echo htmlspecialchars($vars['view']); ?>',
                graph: '<?php echo htmlspecialchars($vars['graph']); ?>',
<object data="graph-realtime.php?type=bits&id=<?php echo $port['port_id'] . '&interval=' . htmlspecialchars($vars['interval']); ?>" type="image/svg+xml" width="1000" height="400">
<param name="src" value="graph.php?type=bits&id=<?php echo $port['port_id'] . '&interval=' . htmlspecialchars($vars['interval']); ?>" />
                view: '<?php echo htmlspecialchars($vars['view']); ?>'
                view: '<?php echo htmlspecialchars($vars['view']); ?>'
                view: '<?php echo htmlspecialchars($vars['view']); ?>',
                graph_type: '<?php echo htmlspecialchars($graph_type); ?>',
                unit: '<?php echo htmlspecialchars($unit); ?>',
                class: '<?php echo htmlspecialchars($class); ?>'
                view: '<?php echo htmlspecialchars($vars['view']); ?>'
                view: '<?php echo htmlspecialchars($vars['view']); ?>'
        '<input name="from" type="text" class="form-control" id="dtpickerfrom" maxlength="16" value="<?php echo htmlspecialchars($vars['from']); ?>" placeholder="From" data-date-format="YYYY-MM-DD HH:mm">' +
        '&nbsp;&nbsp;<input name="to" type="text" class="form-control" id="dtpickerto" maxlength="16" value="<?php echo htmlspecialchars($vars['to']); ?>" placeholder="To" data-date-format="YYYY-MM-DD HH:mm">' +
            device_id: '<?php echo htmlspecialchars($vars['device_id'] ?? ''); ?>',
            state: '<?php echo htmlspecialchars($vars['state'] ?? ''); ?>',
            ifSpeed: '<?php echo htmlspecialchars($vars['ifSpeed'] ?? ''); ?>',
            ifType: '<?php echo htmlspecialchars($vars['ifType'] ?? ''); ?>',
            port_descr_type: '<?php echo htmlspecialchars($vars['port_descr_type'] ?? ''); ?>',
            ifAlias: '<?php echo htmlspecialchars($vars['ifAlias'] ?? ''); ?>',
            location: '<?php echo htmlspecialchars($vars['location'] ?? '') ?>',
            disabled: '<?php echo htmlspecialchars($vars['disabled'] ?? ''); ?>',
            ignore: '<?php echo htmlspecialchars($vars['ignore'] ?? ''); ?>',
            deleted: '<?php echo htmlspecialchars($vars['deleted'] ?? ''); ?>',
            errors: '<?php echo htmlspecialchars($vars['errors'] ?? ''); ?>',
            group: '<?php echo htmlspecialchars($vars['group'] ?? ''); ?>',
            devicegroup: '<?php echo htmlspecialchars($vars['devicegroup'] ?? ''); ?>',
            device_id: '<?php echo htmlspecialchars($vars['device_id']); ?>',
            searchby: '<?php echo htmlspecialchars($vars['searchby']); ?>',
            searchPhrase: '<?php echo htmlspecialchars($vars['searchPhrase']); ?>',
        '<input name="from" type="text" class="form-control" id="dtpickerfrom" maxlength="16" value="<?php echo htmlspecialchars($vars['from'] ?? ''); ?>" placeholder="From" data-date-format="YYYY-MM-DD HH:mm">' +
        '&nbsp;&nbsp;<input name="to" type="text" class="form-control" id="dtpickerto" maxlength="16" value="<?php echo htmlspecialchars($vars['to'] ?? ''); ?>" placeholder="To" data-date-format="YYYY-MM-DD HH:mm">' +
                view:       '<?php echo htmlspecialchars($vars['view']); ?>',
                graph_type: '<?php echo htmlspecialchars($graph_type); ?>',
                unit:       '<?php echo htmlspecialchars($unit); ?>',
                class:      '<?php echo htmlspecialchars($class); ?>'