rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: In the Linux kernel before 5.2.3, set_geometry in drivers/block/floppy.c does not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It can be triggered by an unprivileged local user when a floppy disk has been inserted. NOTE: QEMU creates the floppy device by default.
Vulnerability ID: CVE-2019-14283
CWE: CWE-190
Severity score: 6.4
Project: https://github.com/torvalds/linux
Published: 2019-07-26
File: drivers/block/floppy.c
Commit message: floppy: fix out-of-bounds read in copy_buffer

This fixes a global out-of-bounds read access in the copy_buffer
function of the floppy driver.

The FDDEFPRM ioctl allows one to set the geometry of a disk.  The sect
and head fields (unsigned int) of the floppy_drive structure are used to
compute the max_sector (int) in the make_raw_rw_request function.  It is
possible to overflow the max_sector.  Next, max_sector is passed to the
copy_buffer function and used in one of the memcpy calls.

An unprivileged user could trigger the bug if the device is accessible,
but requires a floppy disk to be inserted.

The patch adds the check for the .sect * .head multiplication for not
overflowing in the set_geometry function.

The bug was found by syzkaller.

Signed-off-by: Denis Efremov <efremov@ispras.ru>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Denis Efremov

Vulnerable version (before fix):
 static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	int cnt;  	/* sanity checking for parameters. */ 	if (g->sect <= 0 || 	    g->head <= 0 || 	    /* check for zero in F_SECT_PER_TRACK */ 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||

Fixed version (after fix):
 static int set_geometry(unsigned int cmd, struct floppy_struct *g, 	int cnt;  	/* sanity checking for parameters. */ 	if ((int)g->sect <= 0 || 	    (int)g->head <= 0 || 	    /* check for overflow in max_sector */ 	    (int)(g->sect * g->head) <= 0 || 	    /* check for zero in F_SECT_PER_TRACK */ 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 || 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||

Patch:
patch: @@ -3233,8 +3233,10 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
 	int cnt;
 
 	/* sanity checking for parameters. */
-	if (g->sect <= 0 ||
-	    g->head <= 0 ||
+	if ((int)g->sect <= 0 ||
+	    (int)g->head <= 0 ||
+	    /* check for overflow in max_sector */
+	    (int)(g->sect * g->head) <= 0 ||
 	    /* check for zero in F_SECT_PER_TRACK */
 	    (unsigned char)((g->sect << 2) >> FD_SIZECODE(g)) == 0 ||
 	    g->track <= 0 || g->track > UDP->tracks >> STRETCH(g) ||
path: drivers/block/floppy.c
Vulnerability: In app/webroot/js/event-graph.js in MISP 2.4.111, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
Vulnerability ID: CVE-2019-14286
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/MISP/MISP
Published: 2019-07-27
File: app/webroot/js/event-graph.js
Commit message: fix: [security] Fix to stored XSS

- as reported by David Heise
Commit author: mokaddem

Vulnerable version (before fix):
 eventGraph.update_scope(); dataHandler.fetch_data_and_update(true, function() {     var $select = $('#network-typeahead');     dataHandler.get_typeaheadData_search().forEach(function(element) {         $select.append('<option value="' + element + '">' + element + '</option>');     });     $('#network-typeahead').chosen(chosen_options).on('change', function(evt, params) {         var value = params.selected;

Fixed version (after fix):
 eventGraph.update_scope(); dataHandler.fetch_data_and_update(true, function() {     var $select = $('#network-typeahead');     dataHandler.get_typeaheadData_search().forEach(function(element) {         var $option = $('<option></option>');         $option.text(element);         $option.attr('value', $option.text());         $select.append($option);     });     $('#network-typeahead').chosen(chosen_options).on('change', function(evt, params) {         var value = params.selected;

Patch:
patch: @@ -2183,7 +2183,10 @@ eventGraph.update_scope();
 dataHandler.fetch_data_and_update(true, function() {
     var $select = $('#network-typeahead');
     dataHandler.get_typeaheadData_search().forEach(function(element) {
-        $select.append('<option value="' + element + '">' + element + '</option>');
+        var $option = $('<option></option>');
+        $option.text(element);
+        $option.attr('value', $option.text());
+        $select.append($option);
     });
     $('#network-typeahead').chosen(chosen_options).on('change', function(evt, params) {
         var value = params.selected;
path: app/webroot/js/event-graph.js
Vulnerability: SSDP Responder 1.x through 1.5 mishandles incoming network messages, leading to a stack-based buffer overflow by 1 byte. This results in a crash of the server, but only when strict stack checking is enabled. This is caused by an off-by-one error in ssdp_recv in ssdpd.c.
Vulnerability ID: CVE-2019-14323
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/troglobit/ssdp-responder
Published: 2019-07-28
File: ssdpd.c
Commit message: Fix #1: Ensure recv buf is always NUL terminated

Signed-off-by: Joachim Nilsson <troglobit@gmail.com>
Commit author: Joachim Nilsson

Vulnerable version (before fix):
 static void ssdp_recv(int sd) 	ssize_t len; 	struct sockaddr sa; 	socklen_t salen; 	char buf[MAX_PKT_SIZE];  	memset(buf, 0, sizeof(buf)); 	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen); 	if (len > 0) { 		buf[len] = 0;  		if (sa.sa_family != AF_INET) 			return; 

Fixed version (after fix):
 static void ssdp_recv(int sd) 	ssize_t len; 	struct sockaddr sa; 	socklen_t salen; 	char buf[MAX_PKT_SIZE + 1];  	memset(buf, 0, sizeof(buf)); 	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen); 	if (len > 0) { 		if (sa.sa_family != AF_INET) 			return; 

Patch:
patch: @@ -432,13 +432,11 @@ static void ssdp_recv(int sd)
 	ssize_t len;
 	struct sockaddr sa;
 	socklen_t salen;
-	char buf[MAX_PKT_SIZE];
+	char buf[MAX_PKT_SIZE + 1];
 
 	memset(buf, 0, sizeof(buf));
-	len = recvfrom(sd, buf, sizeof(buf), MSG_DONTWAIT, &sa, &salen);
+	len = recvfrom(sd, buf, sizeof(buf) - 1, MSG_DONTWAIT, &sa, &salen);
 	if (len > 0) {
-		buf[len] = 0;
-
 		if (sa.sa_family != AF_INET)
 			return;
path: ssdpd.c
Vulnerability: Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.
Vulnerability ID: CVE-2019-14670
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/firefly-iii/firefly-iii
Published: 2019-08-05
File: app/Http/Controllers/Rule/CreateController.php
Commit message: Fix #2365
Commit author: James Cole

Vulnerable version (before fix):
 public function create(Request $request, RuleGroup $ruleGroup = null)      */     public function createFromBill(Request $request, Bill $bill)     {         $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => $bill->name]));          $this->createDefaultRuleGroup();         $this->createDefaultRule();

Fixed version (after fix):
 public function create(Request $request, RuleGroup $ruleGroup = null)      */     public function createFromBill(Request $request, Bill $bill)     {         $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => e($bill->name)]));          $this->createDefaultRuleGroup();         $this->createDefaultRule();

Patch:
patch: @@ -124,7 +124,7 @@ public function create(Request $request, RuleGroup $ruleGroup = null)
      */
     public function createFromBill(Request $request, Bill $bill)
     {
-        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => $bill->name]));
+        $request->session()->flash('info', (string)trans('firefly.instructions_rule_from_bill', ['name' => e($bill->name)]));
 
         $this->createDefaultRuleGroup();
         $this->createDefaultRule();
path: app/Http/Controllers/Rule/CreateController.php
Vulnerability: An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.
Vulnerability ID: CVE-2019-14750
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/osTicket/osTicket
Published: 2019-08-07
File: setup/inc/class.installer.php
Commit message: xss: Install Form

This addresses an issue reported by Aishwarya Iyer where inserting `<img src
=x onerror = prompt(1)` into any text field on the install form will execute
in the browser after the system is installed and you log in. This is due to
us not sanitizing the content before it’s saved in the database. This adds
`Format::htmlchars()` to the installer to ensure the text field data is
sanitized properly.
Commit author: JediKev

Vulnerable version (before fix):
 function install($vars) {             'dept_id' => $dept_id,             'role_id' => $role_id,             'email' => $vars['admin_email'],             'firstname' => $vars['fname'],             'lastname' => $vars['lname'],             'username' => $vars['username'],         ));         $staff->updatePerms(array(

Fixed version (after fix):
 function install($vars) {             'dept_id' => $dept_id,             'role_id' => $role_id,             'email' => $vars['admin_email'],             'firstname' => Format::htmlchars($vars['fname']),             'lastname' => Format::htmlchars($vars['lname']),             'username' => $vars['username'],         ));         $staff->updatePerms(array(

Patch:
patch: @@ -188,8 +188,8 @@ function install($vars) {
             'dept_id' => $dept_id,
             'role_id' => $role_id,
             'email' => $vars['admin_email'],
-            'firstname' => $vars['fname'],
-            'lastname' => $vars['lname'],
+            'firstname' => Format::htmlchars($vars['fname']),
+            'lastname' => Format::htmlchars($vars['lname']),
             'username' => $vars['username'],
         ));
         $staff->updatePerms(array(
path: setup/inc/class.installer.php
Vulnerability: In Exiv2 before v0.27.2, there is an integer overflow vulnerability in the WebPImage::getHeaderOffset function in webpimage.cpp. It can lead to a buffer overflow vulnerability and a crash.
Vulnerability ID: CVE-2019-14982
CWE: CWE-190
Severity score: 2.9
Project: https://github.com/Exiv2/exiv2
Published: 2019-08-12
File: src/webpimage.cpp
Commit message: Fix integer overflow by checking size against header_size

Note that the problem occurs when data_size is less than header_size
what causes a buffer overflow in &data[i]

Co-Authored-By: D4N <dan.cermak@cgc-instruments.com>
Commit author: Luis Díaz Más

Vulnerable version (before fix):
 namespace Exiv2 {         }     }      long WebPImage::getHeaderOffset(byte *data, long data_size,                                     byte *header, long header_size) {         long pos = -1;         for (long i=0; i < data_size - header_size; i++) {             if (memcmp(header, &data[i], header_size) == 0) {

Fixed version (after fix):
 namespace Exiv2 {         }     }      long WebPImage::getHeaderOffset(byte* data, long data_size, byte* header, long header_size)     {         if (data_size < header_size) { return -1; }         long pos = -1;         for (long i=0; i < data_size - header_size; i++) {             if (memcmp(header, &data[i], header_size) == 0) {

Patch:
patch: @@ -827,8 +827,9 @@ namespace Exiv2 {
         }
     }
 
-    long WebPImage::getHeaderOffset(byte *data, long data_size,
-                                    byte *header, long header_size) {
+    long WebPImage::getHeaderOffset(byte* data, long data_size, byte* header, long header_size)
+    {
+        if (data_size < header_size) { return -1; }
         long pos = -1;
         for (long i=0; i < data_size - header_size; i++) {
             if (memcmp(header, &data[i], header_size) == 0) {
path: src/webpimage.cpp
Vulnerability: The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
Vulnerability ID: CVE-2019-15074
CWE: CWE-79
Severity score: 6.4
Project: https://github.com/mantisbt/mantisbt
Published: 2019-08-21
File: core/classes/IssueAttachmentTimelineEvent.class.php
Commit message: Fix XSS on timeline (CVE-2019-15074)

Kamran Saifullah reported a stored cross-site scripting (XSS)
vulnerability in Timeline, allowing execution of arbitrary code (if CSP
settings permit it) after uploading an attachment with a crafted
filename. The code is executed for any user having visibility to the
issue, whenever My View Page is displayed.

Prevent the attack by sanitizing the filename before display.

Fixes #25995
Commit author: Damien Regad

Vulnerable version (before fix):
 public function html() { 			. sprintf( lang_get( $t_string ), 				prepare_user_name( $this->user_id ), 				$t_bug_link, 				$this->filename 			) 			. '</div>'; 		$t_html .= $this->html_end();

Fixed version (after fix):
 public function html() { 			. sprintf( lang_get( $t_string ), 				prepare_user_name( $this->user_id ), 				$t_bug_link, 				string_html_specialchars( $this->filename ) 			) 			. '</div>'; 		$t_html .= $this->html_end();

Patch:
patch: @@ -73,7 +73,7 @@ public function html() {
 			. sprintf( lang_get( $t_string ),
 				prepare_user_name( $this->user_id ),
 				$t_bug_link,
-				$this->filename
+				string_html_specialchars( $this->filename )
 			)
 			. '</div>';
 		$t_html .= $this->html_end();
path: core/classes/IssueAttachmentTimelineEvent.class.php
Vulnerability: WriteTIFFImage in coders/tiff.c in ImageMagick 7.0.8-43 Q16 allows attackers to cause a denial-of-service (application crash resulting from a heap-based buffer over-read) via a crafted TIFF image file, related to TIFFRewriteDirectory, TIFFWriteDirectory, TIFFWriteDirectorySec, and TIFFWriteDirectoryTagColormap in tif_dirwrite.c of LibTIFF. NOTE: this occurs because of an incomplete fix for CVE-2019-11597.
Vulnerability ID: CVE-2019-15141
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick6
Published: 2019-08-18
File: coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1560
Commit author: Cristy

Vulnerable version (before fix):
 RestoreMSCWarning     if (image->colorspace == LabColorspace)       DecodeLabImage(image,&image->exception);     DestroyTIFFInfo(&tiff_info);     if (image->exception.severity > ErrorException)       break; DisableMSCWarning(4127)     if (0 && (image_info->verbose != MagickFalse)) RestoreMSCWarning       TIFFPrintDirectory(tiff,stdout,MagickFalse);     (void) TIFFWriteDirectory(tiff);     image=SyncNextImageInList(image);     if (image == (Image *) NULL)       break; RestoreMSCWarning       break;   } while (image_info->adjoin != MagickFalse);   TIFFClose(tiff);   return(image->exception.severity > ErrorException ? MagickFalse : MagickTrue); } #endif

Fixed version (after fix):
 RestoreMSCWarning     if (image->colorspace == LabColorspace)       DecodeLabImage(image,&image->exception);     DestroyTIFFInfo(&tiff_info); DisableMSCWarning(4127)     if (0 && (image_info->verbose != MagickFalse)) RestoreMSCWarning       TIFFPrintDirectory(tiff,stdout,MagickFalse);     if (TIFFWriteDirectory(tiff) == 0)       {         status=MagickFalse;         break;       }     image=SyncNextImageInList(image);     if (image == (Image *) NULL)       break; RestoreMSCWarning       break;   } while (image_info->adjoin != MagickFalse);   TIFFClose(tiff);   return(status); } #endif

Patch:
patch: @@ -4079,13 +4079,15 @@ RestoreMSCWarning
     if (image->colorspace == LabColorspace)
       DecodeLabImage(image,&image->exception);
     DestroyTIFFInfo(&tiff_info);
-    if (image->exception.severity > ErrorException)
-      break;
 DisableMSCWarning(4127)
     if (0 && (image_info->verbose != MagickFalse))
 RestoreMSCWarning
       TIFFPrintDirectory(tiff,stdout,MagickFalse);
-    (void) TIFFWriteDirectory(tiff);
+    if (TIFFWriteDirectory(tiff) == 0)
+      {
+        status=MagickFalse;
+        break;
+      }
     image=SyncNextImageInList(image);
     if (image == (Image *) NULL)
       break;
@@ -4094,6 +4096,6 @@ RestoreMSCWarning
       break;
   } while (image_info->adjoin != MagickFalse);
   TIFFClose(tiff);
-  return(image->exception.severity > ErrorException ? MagickFalse : MagickTrue);
+  return(status);
 }
 #endif
path: coders/tiff.c
Vulnerability: rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daemon crash) if a crypt() call fails.
Vulnerability ID: CVE-2019-15163
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/the-tcpdump-group/libpcap
Published: 2019-10-03
File: rpcapd/daemon.c
Commit message: Don't crash if crypt() fails.

It can fail, so make sure it doesn't before comparing its result with
the password.

This addresses Include Security issue F12: [libpcap] Remote Packet
Capture Daemon Null Pointer Dereference Denial of Service.
Commit author: Guy Harris

Vulnerable version (before fix):
 daemon_AuthUserPwd(char *username, char *password, char *errbuf) #ifdef HAVE_GETSPNAM 	struct spwd *usersp; #endif  	// This call is needed to get the uid 	if ((user = getpwnam(username)) == NULL) daemon_AuthUserPwd(char *username, char *password, char *errbuf) 	user_password = user->pw_passwd; #endif  	if (strcmp(user_password, (char *) crypt(password, user_password)) != 0) 	{ 		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed: user name or password incorrect"); 		return -1;

Fixed version (after fix):
 daemon_AuthUserPwd(char *username, char *password, char *errbuf) #ifdef HAVE_GETSPNAM 	struct spwd *usersp; #endif 	char *crypt_password;  	// This call is needed to get the uid 	if ((user = getpwnam(username)) == NULL) daemon_AuthUserPwd(char *username, char *password, char *errbuf) 	user_password = user->pw_passwd; #endif  	crypt_password = crypt(password, user_password); 	if (crypt_password == NULL) 	{ 		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed"); 		return -1; 	} 	if (strcmp(user_password, crypt_password) != 0) 	{ 		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed: user name or password incorrect"); 		return -1;

Patch:
patch: @@ -1222,6 +1222,7 @@ daemon_AuthUserPwd(char *username, char *password, char *errbuf)
 #ifdef HAVE_GETSPNAM
 	struct spwd *usersp;
 #endif
+	char *crypt_password;
 
 	// This call is needed to get the uid
 	if ((user = getpwnam(username)) == NULL)
@@ -1252,7 +1253,13 @@ daemon_AuthUserPwd(char *username, char *password, char *errbuf)
 	user_password = user->pw_passwd;
 #endif
 
-	if (strcmp(user_password, (char *) crypt(password, user_password)) != 0)
+	crypt_password = crypt(password, user_password);
+	if (crypt_password == NULL)
+	{
+		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed");
+		return -1;
+	}
+	if (strcmp(user_password, crypt_password) != 0)
 	{
 		pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Authentication failed: user name or password incorrect");
 		return -1;
path: rpcapd/daemon.c
Vulnerability: An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a local DoS attack vector, but it might result as well in remote DoS if the XFS filesystem is exported for instance via NFS.
Vulnerability ID: CVE-2019-15538
CWE: CWE-400
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2019-08-25
File: fs/xfs/xfs_iops.c
Commit message: xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT

Benjamin Moody reported to Debian that XFS partially wedges when a chgrp
fails on account of being out of disk quota.  I ran his reproducer
script:

# adduser dummy
# adduser dummy plugdev

# dd if=/dev/zero bs=1M count=100 of=test.img
# mkfs.xfs test.img
# mount -t xfs -o gquota test.img /mnt
# mkdir -p /mnt/dummy
# chown -c dummy /mnt/dummy
# xfs_quota -xc 'limit -g bsoft=100k bhard=100k plugdev' /mnt

(and then as user dummy)

$ dd if=/dev/urandom bs=1M count=50 of=/mnt/dummy/foo
$ chgrp plugdev /mnt/dummy/foo

and saw:

================================================
WARNING: lock held when returning to user space!
5.3.0-rc5 #rc5 Tainted: G        W
------------------------------------------------
chgrp/47006 is leaving the kernel with locks still held!
1 lock held by chgrp/47006:
 #0: 000000006664ea2d (&xfs_nondir_ilock_class){++++}, at: xfs_ilock+0xd2/0x290 [xfs]

...which is clearly caused by xfs_setattr_nonsize failing to unlock the
ILOCK after the xfs_qm_vop_chown_reserve call fails.  Add the missing
unlock.

Reported-by: benjamin.moody@gmail.com
Fixes: 253f4911f297 ("xfs: better xfs_trans_alloc interface")
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Commit author: Darrick J. Wong

Vulnerable version (before fix):
 xfs_setattr_nonsize(  out_cancel: 	xfs_trans_cancel(tp); out_dqrele: 	xfs_qm_dqrele(udqp); 	xfs_qm_dqrele(gdqp);

Fixed version (after fix):
 xfs_setattr_nonsize(  out_cancel: 	xfs_trans_cancel(tp); 	xfs_iunlock(ip, XFS_ILOCK_EXCL); out_dqrele: 	xfs_qm_dqrele(udqp); 	xfs_qm_dqrele(gdqp);

Patch:
patch: @@ -793,6 +793,7 @@ xfs_setattr_nonsize(
 
 out_cancel:
 	xfs_trans_cancel(tp);
+	xfs_iunlock(ip, XFS_ILOCK_EXCL);
 out_dqrele:
 	xfs_qm_dqrele(udqp);
 	xfs_qm_dqrele(gdqp);
path: fs/xfs/xfs_iops.c
Vulnerability: The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed when editing the document's page.
Vulnerability ID: CVE-2019-15539
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mantisbt/mantisbt
Published: 2020-03-19
File: proj_doc_edit_page.php
Commit message: Fix XSS on project documentation

Vulnerability in deprecated project documentation functionality
($g_enable_project_documentation), allowing execution of arbitrary
code (if CSP settings permit it) after uploading an attachment with a
crafted filename.

Prevent the attack by sanitizing the filename before display.

Fixes #26078
Commit author: Roland Becker

Vulnerable version (before fix):
 			$t_href = '<a href="file_download.php?file_id='.$v_id.'&amp;type=doc">'; 			echo $t_href; 			print_file_icon( $v_filename ); 			echo '</a>&#160;' . $t_href . file_get_display_name( $v_filename ) . '</a>'; 		?> 	</td> </tr>

Fixed version (after fix):
 			$t_href = '<a href="file_download.php?file_id='.$v_id.'&amp;type=doc">'; 			echo $t_href; 			print_file_icon( $v_filename ); 			echo '</a>&#160;' . $t_href . string_html_specialchars( file_get_display_name( $v_filename ) ) . '</a>'; 		?> 	</td> </tr>

Patch:
patch: @@ -122,7 +122,7 @@
 			$t_href = '<a href="file_download.php?file_id='.$v_id.'&amp;type=doc">';
 			echo $t_href;
 			print_file_icon( $v_filename );
-			echo '</a>&#160;' . $t_href . file_get_display_name( $v_filename ) . '</a>';
+			echo '</a>&#160;' . $t_href . string_html_specialchars( file_get_display_name( $v_filename ) ) . '</a>';
 		?>
 	</td>
 </tr>
path: proj_doc_edit_page.php