Vulnerability: Cross-site Scripting in snipe-it Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Vulnerability ID: GHSA-p885-prv3-m4xv
CWE: CWE-79
Severity score: 5.4
Project: https://github.com/snipe/snipe-it
Published: 2022-04-17
File: app/Http/Controllers/Api/ProfileController.php
Commit message: Merge pull request #10942 from snipe/fixes/xss_user_requested

Fixes potential XSS vuln in user requestable results
Commit author: snipe

Vulnerable version (before fix):
 public function requestedAssets()             // Make sure the asset and request still exist             if ($checkoutRequest && $checkoutRequest->itemRequested()) {                 $results['rows'][] = [                     'image' => $checkoutRequest->itemRequested()->present()->getImageUrl(),                     'name' => $checkoutRequest->itemRequested()->present()->name(),                     'type' => $checkoutRequest->itemType(),                     'qty' => $checkoutRequest->quantity,                     'location' => ($checkoutRequest->location()) ? $checkoutRequest->location()->name : null,                     'expected_checkin' => Helper::getFormattedDateObject($checkoutRequest->itemRequested()->expected_checkin, 'datetime'),                     'request_date' => Helper::getFormattedDateObject($checkoutRequest->created_at, 'datetime'),                 ];

Fixed version (after fix):
 public function requestedAssets()             // Make sure the asset and request still exist             if ($checkoutRequest && $checkoutRequest->itemRequested()) {                 $results['rows'][] = [                     'image' => e($checkoutRequest->itemRequested()->present()->getImageUrl()),                     'name' => e($checkoutRequest->itemRequested()->present()->name()),                     'type' => e($checkoutRequest->itemType()),                     'qty' => (int) $checkoutRequest->quantity,                     'location' => ($checkoutRequest->location()) ? e($checkoutRequest->location()->name) : null,                     'expected_checkin' => Helper::getFormattedDateObject($checkoutRequest->itemRequested()->expected_checkin, 'datetime'),                     'request_date' => Helper::getFormattedDateObject($checkoutRequest->created_at, 'datetime'),                 ];

Patch:
patch: @@ -30,11 +30,11 @@ public function requestedAssets()
             // Make sure the asset and request still exist
             if ($checkoutRequest && $checkoutRequest->itemRequested()) {
                 $results['rows'][] = [
-                    'image' => $checkoutRequest->itemRequested()->present()->getImageUrl(),
-                    'name' => $checkoutRequest->itemRequested()->present()->name(),
-                    'type' => $checkoutRequest->itemType(),
-                    'qty' => $checkoutRequest->quantity,
-                    'location' => ($checkoutRequest->location()) ? $checkoutRequest->location()->name : null,
+                    'image' => e($checkoutRequest->itemRequested()->present()->getImageUrl()),
+                    'name' => e($checkoutRequest->itemRequested()->present()->name()),
+                    'type' => e($checkoutRequest->itemType()),
+                    'qty' => (int) $checkoutRequest->quantity,
+                    'location' => ($checkoutRequest->location()) ? e($checkoutRequest->location()->name) : null,
                     'expected_checkin' => Helper::getFormattedDateObject($checkoutRequest->itemRequested()->expected_checkin, 'datetime'),
                     'request_date' => Helper::getFormattedDateObject($checkoutRequest->created_at, 'datetime'),
                 ];
path: app/Http/Controllers/Api/ProfileController.php