GHSA-pf56-h9qf-rxq4: @saltcorn/server Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pf56-h9qf-rxq4",
  "modified" : "2024-10-07T15:14:40Z",
  "published" : "2024-10-07T15:14:40Z",
  "aliases" : [ ],
  "summary" : "Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page",
  "details" : "### Summary\n\nEvent log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445\n\n```js\nrouter.get(\n  \"/:id\",\n  isAdmin,\n  error_catcher(async (req, res) => {\n    const { id } = req.params;\n    const ev = await EventLog.findOneWithUser(id);\n    send_events_page({\n      [...]\n      contents: {\n        type: \"card\",\n        contents:\n          [...]\n          ) +\n          div(\n            { class: \"eventpayload\" },\n            ev.payload ? pre(JSON.stringify(ev.payload, null, 2)) : \"\" //<---\n          ),\n      },\n    });\n  })\n\n```\n\n\n### PoC\n\nThe following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled.\n\nTo demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user.\n\n1. create a table with one column of type string set read/write permission to staff users (just as an example)\n  - visit `http://localhost:3000/table/new`\n  - create a table with `Table name` `my_table_xss` and click `Create`\n  - click `Add field` to add a field with `Label` called `payload` of type `String` and click `Next >>`\n  - leave default values for `Attributes` and click `Next >>` - it should redirect to `http://localhost:3000/table/<table-number>`\n  - under `Edit table properties`, set `Minimum role to read` and `Minimum role to write` to `staff`\n\n2. create an edit view so that staff users can insert more data\n  - visit `http://localhost:3000/viewedit` anc click `Create View`\n  - set the following values:\n    - `View name`: `my_xss_view`\n    - `View pattern`: `Edit`\n    - `Table`: `my_table_xss`\n    - `Minimum role`: `staff`\n  - click `Configure >>`\n  - on page `http://localhost:3000/viewedit/config/my_xss_view` click `Next >>` and then `Finish >>`\n  - you should see a message `View my_xss_view saved`\n\n3. edit the site structure to add the View just created so that `staff` users can access it\n  - visit `http://localhost:3000/menu`\n  - set the following values:\n    - `Type`: `View`\n    - `View`: `my_xss_view [Edit]`\n    - `Text label`: `view`\n    - `Minimum role`: `staff`\n  - click `Add`\n\n4. create an event that will log when data is inserted in the `my_table_xss` table create at step 1\n  - visit `http://localhost:3000/eventlog/settings`\n  - under `Which events should be logged?` select:\n    - `[X] Insert`\n    - `[X] Insert my_table_xss`\n\nLogin with a user with staff role (you can do the same steps also with an admin user)\n- visit `http://localhost:3000/view/my_xss_view`\n- in the `payload` field insert ``\"<svg/onload=alert(`xss`)>`` and click `Save`\n\n\nWith an admin user inspect the log entry generated by the above action:\n- visit `http://localhost:3000/eventlog`\n- click on the event log generated (`http://localhost:3000/eventlog/<event-number>`)\n- an alert will appear\n\n\n### Impact\n\nStored Cross-Site Scripting (XSS)\n\n### Recommended Mitigation\n\nSanitize the user input before building HTML elements",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@saltcorn/server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.0.0-beta.16"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/saltcorn/saltcorn/security/advisories/GHSA-pf56-h9qf-rxq4"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/saltcorn/saltcorn/commit/3c551261d0e230635774798009951fa83a07cc3a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/saltcorn/saltcorn"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-10-07T15:14:40Z",
    "nvd_published_at" : null
  }
}