Vulnerability: XSS vulnerability in theme config file in Mautic ### Impact
Mautic before v2.13.0 has stored XSS via a theme config file.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability ID: GHSA-5w74-jx7m-x6hv
CWE: CWE-79
Severity score: 6.1
Project: https://github.com/mautic/mautic
Published: 2021-01-19
File: app/bundles/CoreBundle/Views/Theme/list.html.php
Commit message: Merge remote-tracking branch 'security/master.config-xss-2018-03-13'
Commit author: Alan Hartless

Vulnerable version (before fix):
                                         <div class="modal-header">                                             <button type="button" class="close" data-dismiss="modal" aria-label="Close">                                                 <span aria-hidden="true">&times;</span></button>                                             <h4 class="modal-title" id="<?php echo $k; ?>"><?php echo $item['name']; ?></h4>                                         </div>                                         <div class="modal-body">                                             <div style="background-image: url(<?php echo $thumbnailUrl ?>);background-repeat:no-repeat;background-size:contain; background-position:center; width: 100%; height: 600px"></div>                     </td>                     <td>                         <div>                             <?php echo $item['name']; ?> (<?php echo $item['key']; ?>)                         </div>                     </td>                     <td>                         <div>                             <?php if (isset($item['config']['authorUrl'])) : ?>                                 <a href="<?php echo $item['config']['authorUrl']; ?>" target="_blank">                                     <?php echo $item['config']['author']; ?>                                 </a>                             <?php elseif (isset($item['config']['author'])) : ?>                                 <?php echo $item['config']['author']; ?>                             <?php endif; ?>                         </div>                     </td>                             <?php foreach ($item['config']['features'] as $feature) : ?>                                 <span style="white-space: nowrap;">                                     <span class="label label-default pa-4">                                         <?php echo $view['translator']->trans('mautic.core.theme.feature.'.$feature); ?>                                     </span>                                 </span>                             <?php endforeach; ?>

Fixed version (after fix):
                                         <div class="modal-header">                                             <button type="button" class="close" data-dismiss="modal" aria-label="Close">                                                 <span aria-hidden="true">&times;</span></button>                                             <h4 class="modal-title" id="<?php echo $k; ?>"><?php echo $view->escape($item['name']); ?></h4>                                         </div>                                         <div class="modal-body">                                             <div style="background-image: url(<?php echo $thumbnailUrl ?>);background-repeat:no-repeat;background-size:contain; background-position:center; width: 100%; height: 600px"></div>                     </td>                     <td>                         <div>                             <?php echo $view->escape($item['name']); ?> (<?php echo $view->escape($item['key']); ?>)                         </div>                     </td>                     <td>                         <div>                             <?php if (isset($item['config']['authorUrl'])) : ?>                                 <a href="<?php echo $item['config']['authorUrl']; ?>" target="_blank">                                     <?php echo $view->escape($item['config']['author']); ?>                                 </a>                             <?php elseif (isset($item['config']['author'])) : ?>                                 <?php echo $view->escape($item['config']['author']); ?>                             <?php endif; ?>                         </div>                     </td>                             <?php foreach ($item['config']['features'] as $feature) : ?>                                 <span style="white-space: nowrap;">                                     <span class="label label-default pa-4">                                         <?php echo $view['translator']->trans('mautic.core.theme.feature.'.$view->escape($feature)); ?>                                     </span>                                 </span>                             <?php endforeach; ?>

Patch:
patch: @@ -107,7 +107,7 @@
                                         <div class="modal-header">
                                             <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                                                 <span aria-hidden="true">&times;</span></button>
-                                            <h4 class="modal-title" id="<?php echo $k; ?>"><?php echo $item['name']; ?></h4>
+                                            <h4 class="modal-title" id="<?php echo $k; ?>"><?php echo $view->escape($item['name']); ?></h4>
                                         </div>
                                         <div class="modal-body">
                                             <div style="background-image: url(<?php echo $thumbnailUrl ?>);background-repeat:no-repeat;background-size:contain; background-position:center; width: 100%; height: 600px"></div>
@@ -119,17 +119,17 @@
                     </td>
                     <td>
                         <div>
-                            <?php echo $item['name']; ?> (<?php echo $item['key']; ?>)
+                            <?php echo $view->escape($item['name']); ?> (<?php echo $view->escape($item['key']); ?>)
                         </div>
                     </td>
                     <td>
                         <div>
                             <?php if (isset($item['config']['authorUrl'])) : ?>
                                 <a href="<?php echo $item['config']['authorUrl']; ?>" target="_blank">
-                                    <?php echo $item['config']['author']; ?>
+                                    <?php echo $view->escape($item['config']['author']); ?>
                                 </a>
                             <?php elseif (isset($item['config']['author'])) : ?>
-                                <?php echo $item['config']['author']; ?>
+                                <?php echo $view->escape($item['config']['author']); ?>
                             <?php endif; ?>
                         </div>
                     </td>
@@ -138,7 +138,7 @@
                             <?php foreach ($item['config']['features'] as $feature) : ?>
                                 <span style="white-space: nowrap;">
                                     <span class="label label-default pa-4">
-                                        <?php echo $view['translator']->trans('mautic.core.theme.feature.'.$feature); ?>
+                                        <?php echo $view['translator']->trans('mautic.core.theme.feature.'.$view->escape($feature)); ?>
                                     </span>
                                 </span>
                             <?php endforeach; ?>
path: app/bundles/CoreBundle/Views/Theme/list.html.php