CVE-2019-19617 (published 2019-12-06T03:15Z)

phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/phpmyadmin/phpmyadmin
commit_details: repo_url: https://github.com/phpmyadmin/phpmyadmin
author: Maurício Meneghini Fauth
author_date: 2019-10-18 18:03:53-03:00
msg: Escape Git information on the index page

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>
repository: repo_url: https://github.com/phpmyadmin/phpmyadmin
repo_name: phpmyadmin/phpmyadmin
description: A web interface for MySQL and MariaDB
repo_language: PHP
owner: phpmyadmin
file_changes: filename: GitRevision.php
change_type: ModificationType.MODIFY
diff: @@ -43,27 +43,32 @@ public static function display()
         );
         $commit_hash = '<strong title="'
             . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_MESSAGE'))
-            . '">' . $commit_hash . '</strong>';
+            . '">' . htmlspecialchars($commit_hash) . '</strong>';
         if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTECOMMIT')) {
             $commit_hash = '<a href="'
                 . Core::linkURL(
                     'https://github.com/phpmyadmin/phpmyadmin/commit/'
-                    . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH')
+                    . htmlspecialchars($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_COMMITHASH'))
                 )
                 . '" rel="noopener noreferrer" target="_blank">' . $commit_hash . '</a>';
         }
 
         $branch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH');
-        if ($GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH')) {
+        $isRemoteBranch = $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_ISREMOTEBRANCH');
+        if ($isRemoteBranch) {
             $branch = '<a href="'
                 . Core::linkURL(
                     'https://github.com/phpmyadmin/phpmyadmin/tree/'
                     . $GLOBALS['PMA_Config']->get('PMA_VERSION_GIT_BRANCH')
                 )
-                . '" rel="noopener noreferrer" target="_blank">' . $branch . '</a>';
+                . '" rel="noopener noreferrer" target="_blank">' . htmlspecialchars($branch) . '</a>';
         }
         if ($branch !== false) {
-            $branch = sprintf(__('%1$s from %2$s branch'), $commit_hash, $branch);
+            $branch = sprintf(
+                __('%1$s from %2$s branch'),
+                $commit_hash,
+                $isRemoteBranch ? $branch : htmlspecialchars($branch)
+            );
         } else {
             $branch = $commit_hash . ' (' . __('no branch') . ')';
         }

programming_language: PHP
filename: Footer.php
change_type: ModificationType.MODIFY
diff: @@ -83,10 +83,10 @@ private function _getDemoMessage()
             include './revision-info.php';
             $message .= sprintf(
                 __('Currently running Git revision %1$s from the %2$s branch.'),
-                '<a target="_blank" rel="noopener noreferrer" href="' . $repobase . $fullrevision . '">'
-                . $revision . '</a>',
-                '<a target="_blank" rel="noopener noreferrer" href="' . $repobranchbase . $branch . '">'
-                . $branch . '</a>'
+                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobase . $fullrevision) . '">'
+                . htmlspecialchars($revision) . '</a>',
+                '<a target="_blank" rel="noopener noreferrer" href="' . htmlspecialchars($repobranchbase . $branch) . '">'
+                . htmlspecialchars($branch) . '</a>'
             );
         } else {
             $message .= __('Git information missing!');

programming_language: PHP