Vulnerability: In PrestaShop before version 1.7.6.5, there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.
Vulnerability ID: CVE-2020-5264
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/PrestaShop/PrestaShop
Published: 2020-04-20
File: src/PrestaShopBundle/Controller/Admin/SecurityController.php
Commit message: Merge pull request from GHSA-48vj-vvr6-jj4f

The url must be tested before used as a button link
Commit author: GoT

Vulnerable version (before fix):
  use PrestaShopBundle\Service\Routing\Router as PrestaShopRouter; use Symfony\Component\HttpFoundation\Request;  /**  * Admin controller to manage security pages. class SecurityController extends FrameworkBundleAdminController     public function compromisedAccessAction(Request $request)     {         $requestUri = urldecode($request->query->get('uri'));          // getToken() actually generate a new token         $username = $this->get('prestashop.user_provider')->getUsername(); public function compromisedAccessAction(Request $request)          $newUri = PrestaShopRouter::generateTokenizedUrl($requestUri, $newToken);          return $this->render('@PrestaShop/Admin/Security/compromised.html.twig', array(             'requestUri' => $newUri,         ));     } }

Fixed version (after fix):
  use PrestaShopBundle\Service\Routing\Router as PrestaShopRouter; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\Validator\Constraints as Assert;  /**  * Admin controller to manage security pages. class SecurityController extends FrameworkBundleAdminController     public function compromisedAccessAction(Request $request)     {         $requestUri = urldecode($request->query->get('uri'));         $url = new Assert\Url();         $violations = $this->get('validator')->validate($requestUri, [$url]);         if ($violations->count()) {             return $this->redirect('dashboard');         }          // getToken() actually generate a new token         $username = $this->get('prestashop.user_provider')->getUsername(); public function compromisedAccessAction(Request $request)          $newUri = PrestaShopRouter::generateTokenizedUrl($requestUri, $newToken);          return $this->render(             '@PrestaShop/Admin/Security/compromised.html.twig',             array(                 'requestUri' => $newUri,             )         );     } }

Patch:
patch: @@ -28,6 +28,7 @@
 
 use PrestaShopBundle\Service\Routing\Router as PrestaShopRouter;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Validator\Constraints as Assert;
 
 /**
  * Admin controller to manage security pages.
@@ -37,6 +38,11 @@ class SecurityController extends FrameworkBundleAdminController
     public function compromisedAccessAction(Request $request)
     {
         $requestUri = urldecode($request->query->get('uri'));
+        $url = new Assert\Url();
+        $violations = $this->get('validator')->validate($requestUri, [$url]);
+        if ($violations->count()) {
+            return $this->redirect('dashboard');
+        }
 
         // getToken() actually generate a new token
         $username = $this->get('prestashop.user_provider')->getUsername();
@@ -47,8 +53,11 @@ public function compromisedAccessAction(Request $request)
 
         $newUri = PrestaShopRouter::generateTokenizedUrl($requestUri, $newToken);
 
-        return $this->render('@PrestaShop/Admin/Security/compromised.html.twig', array(
-            'requestUri' => $newUri,
-        ));
+        return $this->render(
+            '@PrestaShop/Admin/Security/compromised.html.twig',
+            array(
+                'requestUri' => $newUri,
+            )
+        );
     }
 }
path: src/PrestaShopBundle/Controller/Admin/SecurityController.php