CVE-2016-4847 (PHP, published 2017-04-20T17:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ossec/ossec-wui
Files changed:
site/search.php
Commit message: Unanchored regex would allow badness through.  This patch eliminates a
XSS identified by JPCERT Reference number: JVN#58455472


Vulnerable code:
       
    if(preg_match('/[a-z0-9]+/', $_POST['searchid']))
{             
{             
{             
    if((is_numeric($_POST['level'])) && 
    $lcpattern = "/^[0-9a-zA-Z.: _|^!>\/\\-]{1,156}$/";    
}    
    <td>From: &nbsp;<input type="text" name="initdate" 
    value="'.date('Y-m-d H:i', $u_init_time).'" maxlength="16" 
    value="'.date('Y-m-d H:i', $u_final_time).'" maxlength="16" 
echo '<tr><td><input type="radio" name="monitoring" value="1" '.$rt_sk.'/></td> 
echo '</td></tr><tr><td>    
    Pattern: </td><td><input type="text" name="strpattern" size="16" 
echo '</td></tr><tr><td>    
    <input type="text" name="srcippattern" size="16" class="formText" 
    User: </td><td><input type="text" name="userpattern" size="8" 
echo '<tr><td>    
    <input type="text" name="locationpattern" size="16" class="formText" 
    Rule id: </td><td><input type="text" name="rulepattern" size="8" 
/* Agent */    
    
    <tr><td>                    
button          :   "i_trigger", 
button          :   "f_trigger", 
                                   $USER_init, $USER_final, 
                   
    <input type="hidden" name="initdate" 
           value="'.date('Y-m-d H:i', $u_init_time).'" /> 
    <input type="hidden" name="finaldate" 
           value="'.date('Y-m-d H:i', $u_final_time).'" /> 
    <input type="hidden" name="max_alerts_per_page" 
{    
echo '    
           class="formText" />      
if(!isset($output_list[0]{$real_page}) || 

Fixed code:

    if(preg_match('/^[a-z0-9]+$/', $_POST['searchid']))
{
{
{
    if((is_numeric($_POST['level'])) &&
    $lcpattern = "/^[0-9a-zA-Z.: _|^!>\/\\-]{1,156}$/";
}
    <td>From: &nbsp;<input type="text" name="initdate"
    value="'.date('Y-m-d H:i', $u_init_time).'" maxlength="16"
    value="'.date('Y-m-d H:i', $u_final_time).'" maxlength="16"
echo '<tr><td><input type="radio" name="monitoring" value="1" '.$rt_sk.'/></td>
echo '</td></tr><tr><td>
    Pattern: </td><td><input type="text" name="strpattern" size="16"
echo '</td></tr><tr><td>
    <input type="text" name="srcippattern" size="16" class="formText"
    User: </td><td><input type="text" name="userpattern" size="8"
echo '<tr><td>
    <input type="text" name="locationpattern" size="16" class="formText"
    Rule id: </td><td><input type="text" name="rulepattern" size="8"
/* Agent */

    <tr><td>
button          :   "i_trigger",
button          :   "f_trigger",
                                   $USER_init, $USER_final,

    <input type="hidden" name="initdate"
           value="'.date('Y-m-d H:i', $u_init_time).'" />
    <input type="hidden" name="finaldate"
           value="'.date('Y-m-d H:i', $u_final_time).'" />
    <input type="hidden" name="max_alerts_per_page"
{
echo '
           class="formText" />
if(!isset($output_list[0]{$real_page}) ||