CVE-2019-25095 (Other, published 2023-01-05T08:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 6f98076281e9452fdb1adcd1bcbb70a6f968ade9. It is recommended to upgrade the affected component. VDB-217434 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/kakwa/ldapcherry
Files changed:
ldapcherry/__init__.py
resources/templates/adduser.tmpl
resources/templates/login.tmpl
resources/templates/modify.tmpl
resources/templates/selfmodify.tmpl
Commit message: Protect against XSS vulnerabilities in URL redirection

- Switch from base64 to URL encoding for the passing the URL, using the built-in Mako filtering
- Apply HTML filtering to Mako output by default
- Disable HTML filtering for nested templates in adduser, modify, and selfmodify


Vulnerable code:
import base64
            directories=self.template_dir, input_encoding='utf-8'
        if user not authentifaced -> redirection to login page (with base64
        # base64 of the requested URL
        b64requrl = base64.b64encode(cherrypy.url() + qs)
            # return to login page (with base64 of the url in query string
                    "/signin?url=%(url)s" % {'url': b64requrl},
                    "/signin?url=%(url)s" % {'url': b64requrl},
                    "/signin?url=%(url)s" % {'url': b64requrl},
                redirect = base64.b64decode(url)
                qs = '?url=' + url
              ${form}
              ${roles}
<%
if url is None:
    qs=''
else:
    qs='?url=' + url
%>
            <form method='POST' action='/login${qs}' role="form" class="form-signin">
              ${form}
              ${roles}
              ${form}

Fixed code:
import urllib
            directories=self.template_dir, input_encoding='utf-8',
            default_filters=['unicode', 'h']
        if user not authenticated -> redirect to login page (with escaped URL
        # Escaped version of the requested URL
        quoted_requrl = urllib.quote_plus(cherrypy.url() + qs)
            # return to login page (with quoted url in query string)
                    "/signin?url=%(url)s" % {'url': quoted_requrl},
                    "/signin?url=%(url)s" % {'url': quoted_requrl},
                    "/signin?url=%(url)s" % {'url': quoted_requrl},
                redirect = url
                qs = '?url=' + urllib.quote_plus(url)
              ${form | n}
              ${roles | n}
            <form method='POST' role="form" class="form-signin"
% if url:
                action='login?url=${url | u}'
% else:
                action='login'
% endif
            >
              ${form | n}
              ${roles | n}
              ${form | n}