Security Fix for Cross-site Scripting (XSS) - huntr.dev

[huntr-helper]

https://huntr.dev/users/Mik317 has fixed the Cross-site Scripting (XSS) vulnerability 🔨. Mik317 has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/packagist/yidashi/yii2cmf/1/README.md

User Comments:

Bounty URL: https://www.huntr.dev/bounties/1-packagist-yidashi%2Fyii2cmf

⚙️ Description *

The yii2cmf project suffered against a XSS issue which occurred inside the search functionality, which was reachable at the /search?qendpoint. The?qGET parameter value was formatted insecurely inside theHTML, leading to XSS` 😢

💻 Technical Description *

I added a double check:

• htmlentities() in the server-side to avoid the q parameter could result in XSS when formatted using the Search controller
• HTML::encode() in the client-side since the q parameter was formatted directly in the input contained by the header.html file (more info on https://www.yiiframework.com/doc/api/2.0/yii-helpers-basehtml#encode()-detail)

🐛 Proof of Concept (PoC) *

I was unable to install the software, but the PoC and the code made me able to fix the issue

🔥 Proof of Fix (PoF) *

Double checks should solve the issue 😄

👍 User Acceptance Testing (UAT)

All ok 👍