Vulnerability: Cross-site Scripting in Eclipse Hawkbit In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 (Not Found) JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client.
Vulnerability ID: GHSA-rcvx-rmvf-mxch
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/eclipse/hawkbit
Published: 2022-02-09
File: hawkbit-runtime/hawkbit-update-server/src/main/java/org/eclipse/hawkbit/app/ErrorController.java
Commit message: Fixes #1067

JSON body response for HTTP 404 error may contain unsafe URL path characters. Thus removing path from the response

Signed-off-by: Dominic Schabel <dominic.schabel@bosch.io>
Commit author: Dominic Schabel

Vulnerable version (before fix):
  */ package org.eclipse.hawkbit.app;  import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse;  /**  * Error page controller that ensures that ocet stream does not return text in  * case of an error.  *  */ @Controller // Exception squid:S3752 - errors need handling for all methods @SuppressWarnings("squid:S3752") public class StreamAwareErrorController extends BasicErrorController {      /**      * A new {@link StreamAwareErrorController}.      *       * @param errorAttributes      *            the error attributes      * @param serverProperties      *            configuration properties      */     public StreamAwareErrorController(final ErrorAttributes errorAttributes, final ServerProperties serverProperties) {         super(errorAttributes, serverProperties.getError());     }  public ResponseEntity<Void> errorStream(final HttpServletRequest request, final         return new ResponseEntity<>(status);     }  }

Fixed version (after fix):
  */ package org.eclipse.hawkbit.app;  import java.util.Map;  import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse;  /**  * Error page controller that ensures that ocet stream does not return text in  * case of an error.  */ @Controller // Exception squid:S3752 - errors need handling for all methods @SuppressWarnings("squid:S3752") public class ErrorController extends BasicErrorController {      private static final String PATH = "path";      /**      * A new {@link ErrorController}.      *       * @param errorAttributes      *            the error attributes      * @param serverProperties      *            configuration properties      */     public ErrorController(final ErrorAttributes errorAttributes, final ServerProperties serverProperties) {         super(errorAttributes, serverProperties.getError());     }  public ResponseEntity<Void> errorStream(final HttpServletRequest request, final         return new ResponseEntity<>(status);     }      @Override     @RequestMapping     public ResponseEntity<Map<String, Object>> error(final HttpServletRequest request) {         final HttpStatus status = getStatus(request);         final Map<String, Object> body = getErrorAttributesWithoutPath(request);         return new ResponseEntity<>(body, status);     }      private Map<String, Object> getErrorAttributesWithoutPath(final HttpServletRequest request) {         final Map<String, Object> body = getErrorAttributes(request, isIncludeStackTrace(request, MediaType.ALL));         if (body != null && body.containsKey(PATH)) {             body.remove(PATH);         }         return body;     } }

Patch:
patch: @@ -8,6 +8,8 @@
  */
 package org.eclipse.hawkbit.app;
 
+import java.util.Map;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
@@ -23,22 +25,23 @@
 /**
  * Error page controller that ensures that ocet stream does not return text in
  * case of an error.
- *
  */
 @Controller
 // Exception squid:S3752 - errors need handling for all methods
 @SuppressWarnings("squid:S3752")
-public class StreamAwareErrorController extends BasicErrorController {
+public class ErrorController extends BasicErrorController {
+
+    private static final String PATH = "path";
 
     /**
-     * A new {@link StreamAwareErrorController}.
+     * A new {@link ErrorController}.
      * 
      * @param errorAttributes
      *            the error attributes
      * @param serverProperties
      *            configuration properties
      */
-    public StreamAwareErrorController(final ErrorAttributes errorAttributes, final ServerProperties serverProperties) {
+    public ErrorController(final ErrorAttributes errorAttributes, final ServerProperties serverProperties) {
         super(errorAttributes, serverProperties.getError());
     }
 
@@ -48,4 +51,19 @@ public ResponseEntity<Void> errorStream(final HttpServletRequest request, final
         return new ResponseEntity<>(status);
     }
 
+    @Override
+    @RequestMapping
+    public ResponseEntity<Map<String, Object>> error(final HttpServletRequest request) {
+        final HttpStatus status = getStatus(request);
+        final Map<String, Object> body = getErrorAttributesWithoutPath(request);
+        return new ResponseEntity<>(body, status);
+    }
+
+    private Map<String, Object> getErrorAttributesWithoutPath(final HttpServletRequest request) {
+        final Map<String, Object> body = getErrorAttributes(request, isIncludeStackTrace(request, MediaType.ALL));
+        if (body != null && body.containsKey(PATH)) {
+            body.remove(PATH);
+        }
+        return body;
+    }
 }
path: hawkbit-runtime/hawkbit-update-server/src/main/java/org/eclipse/hawkbit/app/ErrorController.java