Vulnerability: A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link.
Vulnerability ID: CVE-2019-11812
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/MISP/MISP
Published: 2019-05-08
File: app/View/Helper/CommandHelper.php
Commit message: fix: [security] Fix persistent xss via discussion links via javascript:// links

- low impact as it requires user interaction to trigger

- as reported by João Lucas Melo Brasio from Elytron Security S.A. (https://elytronsecurity.com)
Commit author: iglocska

Vulnerable version (before fix):
 private function __handleLinks(&$string, $trigger) {                             $replacement = '%MALFORMED URL%';                         } else {                             if (filter_var(str_replace('$1', $data, $this->__replacement[$trigger]['url']), FILTER_VALIDATE_URL)) {                                 $replacement = $this->Html->link(                                     str_replace('$1', $data, $this->__replacement[$trigger]['text']),                                     str_replace('$1', $data, $this->__replacement[$trigger]['url'])                                 );                             } else {                                 $replacement = '%MALFORMED URL%';                             }

Fixed version (after fix):
 private function __handleLinks(&$string, $trigger) {                             $replacement = '%MALFORMED URL%';                         } else {                             if (filter_var(str_replace('$1', $data, $this->__replacement[$trigger]['url']), FILTER_VALIDATE_URL)) {                                 if (substr($data, 0, 7) === 'http://' || substr($data, 0, 8) === 'https://') {                                     $replacement = $this->Html->link(                                         str_replace('$1', $data, $this->__replacement[$trigger]['text']),                                         str_replace('$1', $data, $this->__replacement[$trigger]['url'])                                     );                                 } else {                                     $replacement = '%MALFORMED URL%';                                 }                             } else {                                 $replacement = '%MALFORMED URL%';                             }

Patch:
patch: @@ -68,10 +68,14 @@ private function __handleLinks(&$string, $trigger) {
                             $replacement = '%MALFORMED URL%';
                         } else {
                             if (filter_var(str_replace('$1', $data, $this->__replacement[$trigger]['url']), FILTER_VALIDATE_URL)) {
-                                $replacement = $this->Html->link(
-                                    str_replace('$1', $data, $this->__replacement[$trigger]['text']),
-                                    str_replace('$1', $data, $this->__replacement[$trigger]['url'])
-                                );
+                                if (substr($data, 0, 7) === 'http://' || substr($data, 0, 8) === 'https://') {
+                                    $replacement = $this->Html->link(
+                                        str_replace('$1', $data, $this->__replacement[$trigger]['text']),
+                                        str_replace('$1', $data, $this->__replacement[$trigger]['url'])
+                                    );
+                                } else {
+                                    $replacement = '%MALFORMED URL%';
+                                }
                             } else {
                                 $replacement = '%MALFORMED URL%';
                             }
path: app/View/Helper/CommandHelper.php