CVE-2024-37156 (published 2024-06-06T16:15Z)

The SuluFormBundle adds support for creating dynamic forms in Sulu Admin. The TokenController get parameter formName is not sanitized in the returned input field which leads to XSS. This vulnerability is fixed in 2.5.3.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sulu/SuluFormBundle
commit_details: repo_url: https://github.com/sulu/SuluFormBundle
author: martinlagler
author_date: 2024-06-06 16:09:01+02:00
msg: Merge pull request from GHSA-rrvc-c7xg-7cf3
repository: repo_url: https://github.com/sulu/SuluFormBundle
repo_name: sulu/SuluFormBundle
description: Form Bundle for handling Dynamic and Symfony Forms in https://sulu.io
repo_language: PHP
owner: sulu
file_changes: filename: FormTokenController.php
change_type: ModificationType.MODIFY
diff: @@ -35,6 +35,9 @@ class FormTokenController
         $content = $csrfToken;
 
         if ($request->get('html')) {
+            $formName = htmlspecialchars($formName, ENT_QUOTES, 'UTF-8');
+            $csrfToken = htmlspecialchars($csrfToken, ENT_QUOTES, 'UTF-8');
+
             $content = \sprintf(
                 '<input type="hidden" id="%s__token" name="%s[_token]" value="%s" />',
                 $formName,

programming_language: PHP
filename: FormTokenControllerTest.php
change_type: ModificationType.ADD
diff: @@ -0,0 +1,55 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of Sulu.
+ *
+ * (c) Sulu GmbH
+ *
+ * This source file is subject to the MIT license that is bundled
+ * with this source code in the file LICENSE.
+ */
+
+namespace Sulu\Bundle\FormBundle\Tests\Functional\Controller;
+
+use Sulu\Bundle\FormBundle\Controller\FormTokenController;
+use Sulu\Bundle\TestBundle\Testing\SuluTestCase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Csrf\CsrfToken;
+use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
+
+class FormTokenControllerTest extends SuluTestCase
+{
+    /**
+     * @var FormTokenController
+     */
+    private formTokenController $formTokenController;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $csrfTokenManager = $this->createMock(CsrfTokenManagerInterface::class);
+        $csrfToken = $this->createMock(CsrfToken::class);
+        $csrfToken->method('getValue')->willReturn('testToken');
+        $csrfTokenManager->method('getToken')->willReturn($csrfToken);
+        $this->formTokenController = new FormTokenController($csrfTokenManager);
+    }
+
+    public function testTokenAction(): void
+    {
+        $request = new Request([], [], ['form' => 'testForm', 'html' => true]);
+        $response = $this->formTokenController->tokenAction($request);
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertStringContainsString('testForm', $response->getContent());
+    }
+
+    public function testTokenActionWithScript(): void
+    {
+        $request = new Request([], [], ['form' => '<script>alert(1)</script>', 'html' => true]);
+        $response = $this->formTokenController->tokenAction($request);
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertStringContainsString('&lt;script&gt;alert(1)&lt;/script&gt;', $response->getContent());
+        $this->assertStringNotContainsString('<script>alert(1)</script>', $response->getContent());
+    }
+}

programming_language: PHP