CVE-2023-1149 (Other, published 2023-03-02T05:15Z)
Description: value: Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-76 \u2014 Improper Neutralization of Equivalent Special Elements
The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
Repository: https://github.com/btcpayserver/btcpayserver
Files changed:
BTCPayServer/Views/Shared/Bitcoin/BitcoinLikeMethodCheckoutNoScript.cshtml
BTCPayServer/Views/Shared/Bitcoin/ViewBitcoinLikePaymentData.cshtml
BTCPayServer/Views/Shared/PosData.cshtml
BTCPayServer/Views/UILNURL/EditLightningAddress.cshtml
Commit message: Fix: HTML injection in payment request/posData/receiptData (Close #4678) (#4679)

Co-authored-by: Dennis Reimann <mail@dennisreimann.de>


Vulnerable code:
    <p>To complete payment, please send <b>@Safe.Raw(Model.IsUnsetTopUp? "any amount of": Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
                    <td class="payment-value">@payment.CryptoPaymentData.GetValue() @Safe.Raw(payment.AdditionalInformation is string i ? $"<br/>({i})" : string.Empty)</td>
                    <th class="w-150px">@Safe.Raw(key)</th>
                        <a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
                        @Safe.Raw(value?.ToString())
                    <th class="w-150px">@Safe.Raw(key)</th>
                            <a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
                            @Safe.Raw(subItems.First().Value?.ToString())
                    </td>
                }
                else
                {
                    <td colspan="2" >
                        @Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
@model (Dictionary<string, object> Items, int Level)

@functions {
    private bool IsValidURL(string source)
    {
        return Uri.TryCreate(source, UriKind.Absolute, out var uriResult) && 
            (uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps);
    }
}

<table class="table my-0">
    @foreach (var (key, value) in Model.Items)
    {
        <tr>
            @if (value is string str)
            {
                if (!string.IsNullOrEmpty(key))
                {
                    <th class="w-150px">@Safe.Raw(key)</th>
                }
                <td>
                    @if (IsValidURL(str))
                    {
                        <a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
                    }
                    else
                    {
                        @Safe.Raw(value?.ToString())
                    }
                </td>
            }
            else if (value is Dictionary<string, object>subItems)
            {
                @* This is the array case *@
                if (subItems.Count == 1 && subItems.First().Value is string str2)
                {
                    <th class="w-150px">@Safe.Raw(key)</th>
                    <td>
                        @if (IsValidURL(str2))
                        {
                            <a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
                        }
                        else
                        {
                            @Safe.Raw(subItems.First().Value?.ToString())
                        }
                    </td>
                }
                else
                {
                    <td colspan="2" >
                        @Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
                        <partial name="PosData" model="(subItems, Model.Level + 1)"/>
                    </td>
                }
            }
        </tr>
    }
</table>

                        <input asp-for="Add.CurrencyCode" class="form-control" style="max-width:16ch;"/>
                                    <span>@Safe.Raw($"{Model.Items[index].Min} min sats")</span>
                                    <span> @Safe.Raw($"{Model.Items[index].Max} max sats")</span>
                                    <span> @Safe.Raw($"tracked in {Model.Items[index].CurrencyCode}")</span>

Fixed code:
    <p>To complete payment, please send <b>@(Model.IsUnsetTopUp ? "any amount of" : Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
                    <td class="payment-value">
                        @payment.CryptoPaymentData.GetValue()
                        @if (!string.IsNullOrEmpty(payment.AdditionalInformation))
                        {
                            <div>(@payment.AdditionalInformation)</div>
                        }
                    </td>
                    <th class="w-150px">@key</th>
                        <a href="@str" target="_blank" rel="noreferrer noopener">@str</a>
                        @value?.ToString()
                    <th class="w-150px">@key</th>
                            <a href="@str2" target="_blank" rel="noreferrer noopener">@str2</a>
                            @subItems.First().Value?.ToString()
					</td>
				}
				else
				{
					<td colspan="2" >
						@{
							Write(Html.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">"));
							Write(key);
							Write(Html.Raw($"</h{Model.Level + 3}>"));
						}
                        <input asp-for="Add.CurrencyCode" class="form-control w-auto" currency-selection style="max-width:16ch;"/>
                                    <span>@Model.Items[index].Min min sats</span>
                                    <span>@Model.Items[index].Max max sats</span>
                                    <span>tracked in @Model.Items[index].CurrencyCode</span>