CVE-2023-1149 (published 2023-03-02T05:15Z)

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-76
cwe_name: Improper Neutralization of Equivalent Special Elements
description: The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
extended_description: The product may have a fixed list of special characters it believes is complete. However, there may be alternate encodings, or representations that also have the same meaning. For example, the product may filter out a leading slash (/) to prevent absolute path names, but does not account for a tilde (~) followed by a user name, which on some *nix systems could be expanded to an absolute pathname. Alternately, the product might filter a dangerous "-e" command-line switch when calling an external program, but it might not account for "--exec" or other switches that have the same semantics.
         

Fix information:
repo_url: https://github.com/btcpayserver/btcpayserver
commit_details: repo_url: https://github.com/btcpayserver/btcpayserver
author: Nicolas Dorier
author_date: 2023-02-23 00:35:34+09:00
msg: Fix: HTML injection in payment request/posData/receiptData (Close #4678) (#4679)

Co-authored-by: Dennis Reimann <mail@dennisreimann.de>
repository: repo_url: https://github.com/btcpayserver/btcpayserver
repo_name: btcpayserver/btcpayserver
description: Accept Bitcoin payments. Free, open-source & self-hosted, Bitcoin payment processor. 
repo_language: C#
owner: btcpayserver
file_changes: filename: BitcoinLikeMethodCheckoutNoScript.cshtml
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 @model PaymentModel
 <div>
-    <p>To complete payment, please send <b>@Safe.Raw(Model.IsUnsetTopUp? "any amount of": Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
+    <p>To complete payment, please send <b>@(Model.IsUnsetTopUp ? "any amount of" : Model.BtcDue) @Model.CryptoCode</b> to <b style="word-break: break-word;">@Model.BtcAddress</b></p>
     <p>Time remaining: @Model.TimeLeft</p>
     <p>
         <a href="@Model.InvoiceBitcoinUrl" style="word-break: break-word;" rel="noreferrer noopener">@Model.InvoiceBitcoinUrl</a>

programming_language: Haskell
filename: ViewBitcoinLikePaymentData.cshtml
change_type: ModificationType.MODIFY
diff: @@ -77,7 +77,13 @@
                     <td>@payment.Crypto</td>
                     <td>@(payment.CryptoPaymentData.KeyPath?.ToString()?? "Unknown")</td>
                     <td style="max-width:300px;" data-bs-toggle="tooltip" class="text-truncate" title="@payment.DepositAddress">@payment.DepositAddress</td>
-                    <td class="payment-value">@payment.CryptoPaymentData.GetValue() @Safe.Raw(payment.AdditionalInformation is string i ? $"<br/>({i})" : string.Empty)</td>
+                    <td class="payment-value">
+                        @payment.CryptoPaymentData.GetValue()
+                        @if (!string.IsNullOrEmpty(payment.AdditionalInformation))
+                        {
+                            <div>(@payment.AdditionalInformation)</div>
+                        }
+                    </td>
                     @if (hasNetworkFee)
                     {
                         <td>@payment.NetworkFee</td>

programming_language: PowerShell
filename: PosData.cshtml
change_type: ModificationType.MODIFY
diff: @@ -16,16 +16,16 @@
             {
                 if (!string.IsNullOrEmpty(key))
                 {
-                    <th class="w-150px">@Safe.Raw(key)</th>
+                    <th class="w-150px">@key</th>
                 }
                 <td>
                     @if (IsValidURL(str))
                     {
-                        <a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
+                        <a href="@str" target="_blank" rel="noreferrer noopener">@str</a>
                     }
                     else
                     {
-                        @Safe.Raw(value?.ToString())
+                        @value?.ToString()
                     }
                 </td>
             }
@@ -34,22 +34,26 @@
                 @* This is the array case *@
                 if (subItems.Count == 1 && subItems.First().Value is string str2)
                 {
-                    <th class="w-150px">@Safe.Raw(key)</th>
+                    <th class="w-150px">@key</th>
                     <td>
                         @if (IsValidURL(str2))
                         {
-                            <a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
+                            <a href="@str2" target="_blank" rel="noreferrer noopener">@str2</a>
                         }
                         else
                         {
-                            @Safe.Raw(subItems.First().Value?.ToString())
+                            @subItems.First().Value?.ToString()
                         }
-                    </td>
-                }
-                else
-                {
-                    <td colspan="2" >
-                        @Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
+					</td>
+				}
+				else
+				{
+					<td colspan="2" >
+						@{
+							Write(Html.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">"));
+							Write(key);
+							Write(Html.Raw($"</h{Model.Level + 3}>"));
+						}
                         <partial name="PosData" model="(subItems, Model.Level + 1)"/>
                     </td>
                 }

programming_language: C#
filename: PosData.cshtml
change_type: ModificationType.DELETE
diff: @@ -1,60 +0,0 @@
-@model (Dictionary<string, object> Items, int Level)
-
-@functions {
-    private bool IsValidURL(string source)
-    {
-        return Uri.TryCreate(source, UriKind.Absolute, out var uriResult) && 
-            (uriResult.Scheme == Uri.UriSchemeHttp || uriResult.Scheme == Uri.UriSchemeHttps);
-    }
-}
-
-<table class="table my-0">
-    @foreach (var (key, value) in Model.Items)
-    {
-        <tr>
-            @if (value is string str)
-            {
-                if (!string.IsNullOrEmpty(key))
-                {
-                    <th class="w-150px">@Safe.Raw(key)</th>
-                }
-                <td>
-                    @if (IsValidURL(str))
-                    {
-                        <a href="@Safe.Raw(str)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str)</a>
-                    }
-                    else
-                    {
-                        @Safe.Raw(value?.ToString())
-                    }
-                </td>
-            }
-            else if (value is Dictionary<string, object>subItems)
-            {
-                @* This is the array case *@
-                if (subItems.Count == 1 && subItems.First().Value is string str2)
-                {
-                    <th class="w-150px">@Safe.Raw(key)</th>
-                    <td>
-                        @if (IsValidURL(str2))
-                        {
-                            <a href="@Safe.Raw(str2)" target="_blank" rel="noreferrer noopener">@Safe.Raw(str2)</a>
-                        }
-                        else
-                        {
-                            @Safe.Raw(subItems.First().Value?.ToString())
-                        }
-                    </td>
-                }
-                else
-                {
-                    <td colspan="2" >
-                        @Safe.Raw($"<h{Model.Level + 3} class=\"mt-4 mb-3\">{key}</h{Model.Level + 3}>")
-                        <partial name="PosData" model="(subItems, Model.Level + 1)"/>
-                    </td>
-                }
-            }
-        </tr>
-    }
-</table>
-

programming_language: unknown
filename: EditLightningAddress.cshtml
change_type: ModificationType.MODIFY
diff: @@ -69,7 +69,7 @@
                 <div class="col-12 col-sm-auto">
                     <div class="form-group">
                         <label asp-for="Add.CurrencyCode" class="form-label"></label>
-                        <input asp-for="Add.CurrencyCode" class="form-control" style="max-width:16ch;"/>
+                        <input asp-for="Add.CurrencyCode" class="form-control w-auto" currency-selection style="max-width:16ch;"/>
                         <span asp-validation-for="Add.CurrencyCode" class="text-danger"></span>
                     </div>
                 </div>
@@ -126,15 +126,15 @@
                             <td class="settings-holder align-middle">
                                 @if (Model.Items[index].Min.HasValue)
                                 {
-                                    <span>@Safe.Raw($"{Model.Items[index].Min} min sats")</span>
+                                    <span>@Model.Items[index].Min min sats</span>
                                 }
                                 @if (Model.Items[index].Max.HasValue)
                                 {
-                                    <span> @Safe.Raw($"{Model.Items[index].Max} max sats")</span>
+                                    <span>@Model.Items[index].Max max sats</span>
                                 }
                                 @if (!string.IsNullOrEmpty(Model.Items[index].CurrencyCode))
                                 {
-                                    <span> @Safe.Raw($"tracked in {Model.Items[index].CurrencyCode}")</span>
+                                    <span>tracked in @Model.Items[index].CurrencyCode</span>
                                 }
                             </td>
                             <td class="text-end">

programming_language: HTML