CVE-2022-4930 (Other, published 2023-03-06T16:15Z)
Description: value: A vulnerability classified as problematic was found in nuxsmin sysPass up to 3.2.4. Affected by this vulnerability is an unknown functionality of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.5 is able to address this issue. The patch is named 4da4d031732ecca67519851fd0c34597dbb8ee55. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-222319.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nuxsmin/sysPass
Files changed:
app/modules/web/themes/material-blue/views/account/account-editpass.inc
app/modules/web/themes/material-blue/views/account/account-history.inc
app/modules/web/themes/material-blue/views/account/account.inc
app/modules/web/themes/material-blue/views/account/search-rows.inc
app/modules/web/themes/material-blue/views/config/general-auth.inc
app/modules/web/themes/material-blue/views/config/general-events.inc
app/modules/web/themes/material-blue/views/config/general-proxy.inc
app/modules/web/themes/material-blue/views/config/general-site.inc
app/modules/web/themes/material-blue/views/config/ldap.inc
app/modules/web/themes/material-blue/views/config/mail.inc
app/modules/web/themes/material-blue/views/config/wiki-dokuwiki.inc
app/modules/web/themes/material-blue/views/config/wiki.inc
lib/SP/Services/Install/Installer.php
Commit message: fix: Fix XSS on some URLs (#1832)

* fix: Fix XSS when displaying URL on search account view.

Signed-off-by: Rubén D <nuxsmin@syspass.org>

* fix: Fix XSS when displaying URL on account view.

Signed-off-by: Rubén D <nuxsmin@syspass.org>

* fix: Fix XSS when displaying some URLs.

Signed-off-by: Rubén D <nuxsmin@syspass.org>

* fix: Fix XSS when displaying some URLs.

Signed-off-by: Rubén D <nuxsmin@syspass.org>

* chore: Bump version number.

Signed-off-by: Rubén D <nuxsmin@syspass.org>

Vulnerable code:
                               value="<?php echo $accountData->getUrl(); ?>"
                                       value="<?php echo $accountData->getUrl(); ?>"
                                           ? $accountData->getUrl()
                                <a href="<?php echo $accountSearchData->getUrl(); ?>"
                                   title="<?php printf(__('Open link to: %s'), $accountSearchData->getUrl()); ?>">
                                    <?php echo $accountSearchItem->getShortUrl(); ?>
                                <div class="field-text"><?php echo $accountSearchItem->getShortUrl(); ?></div>
                       value="<?php echo $configData->getAuthBasicDomain(); ?>">
                       value="<?php echo $configData->getSyslogServer(); ?>"/>
                       value="<?php echo $configData->getProxyServer(); ?>">
                       value="<?php echo $configData->getProxyUser(); ?>">
                       value="<?php echo $configData->getApplicationUrl(); ?>"/>
                           value="<?php echo $configData->getLdapServer(); ?>"/>
                           value="<?php echo $configData->getLdapBindUser(); ?>"/>
                           value="<?php echo $configData->getLdapBase(); ?>"/>
                           value="<?php echo $configData->getLdapGroup(); ?>"/>
                           value="<?php echo $configData->getMailServer(); ?>"/>
                           value="<?php echo $configData->getMailUser(); ?>"/>
                           value="<?php echo $configData->getMailFrom(); ?>"/>
                           value="<?php echo $configData->getDokuwikiUrl(); ?>"/>
                           value="<?php echo $configData->getDokuwikiUrlBase(); ?>"/>
                           value="<?php echo $configData->getDokuwikiUser(); ?>"/>
                           value="<?php echo $configData->getWikiSearchurl(); ?>">
                           value="<?php echo $configData->getWikiPageurl(); ?>">
    const VERSION = [3, 2, 4];
    const BUILD = 22052601;

Fixed code:
                               value="<?php echo htmlspecialchars($accountData->getUrl(), ENT_QUOTES); ?>"
                                       value="<?php echo htmlspecialchars($accountData->getUrl(), ENT_QUOTES); ?>"
                                           ? htmlspecialchars($accountData->getUrl(), ENT_QUOTES)
                                <a href="<?php echo urlencode($accountSearchData->getUrl()); ?>"
                                   title="<?php printf(__('Open link to: %s'), htmlspecialchars($accountSearchData->getUrl(), ENT_QUOTES)); ?>">
                                    <?php echo htmlspecialchars($accountSearchItem->getShortUrl(), ENT_QUOTES); ?>
                                <div class="field-text"><?php echo htmlspecialchars($accountSearchItem->getShortUrl(), ENT_QUOTES); ?></div>
                       value="<?php echo htmlspecialchars($configData->getAuthBasicDomain(), ENT_QUOTES); ?>">
                       value="<?php echo htmlspecialchars($configData->getSyslogServer(), ENT_QUOTES); ?>"/>
                       value="<?php echo htmlspecialchars($configData->getProxyServer(), ENT_QUOTES); ?>">
                       value="<?php echo htmlspecialchars($configData->getProxyUser(), ENT_QUOTES); ?>">
                       value="<?php echo htmlspecialchars($configData->getApplicationUrl(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getLdapServer(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getLdapBindUser(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getLdapBase(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getLdapGroup(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getMailServer(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getMailUser(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getMailFrom(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getDokuwikiUrl(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getDokuwikiUrlBase(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getDokuwikiUser(), ENT_QUOTES); ?>"/>
                           value="<?php echo htmlspecialchars($configData->getWikiSearchurl(), ENT_QUOTES); ?>">
                           value="<?php echo htmlspecialchars($configData->getWikiPageurl(), ENT_QUOTES); ?>">
    const VERSION = [3, 2, 5];
    const BUILD = 22060401;