/library/nusoap/0001-Fix-12312-NuSOAP-web-description-XSS-vulnerability.patch

https://github.com/fusenigk/mantisbt-1 · Patch · 119 lines · 112 code · 7 blank · 0 comment · 0 complexity · d639190a9af09a00523157562b0ac27b MD5 · raw file 

    

  1. From edb817991b99cd5538f102be26865fde7c6b7212 Mon Sep 17 00:00:00 2001
    2. 

  2. From: David Hicks <hickseydr@optusnet.com.au>
    3. 

  3. Date: Thu, 2 Sep 2010 21:51:21 +1000
    4. 

  4. Subject: [PATCH] Fix #12312: NuSOAP web description XSS vulnerability
    5. 

  5. 

  6. Bogdan Calin from Acunetix discovered a number of XSS vulnerabilities in
    7. 

  7. NuSOAP 0.9.5 (bundled with MantisBT) relating to improperly escaped
    8. 

  8. URLs.
    9. 

  9. 

  10. A sample exploit URL is:
    11. 

  11. /api/soap/mantisconnect.php?1<ScRiPt>prompt(923395)</ScRiPt>
    12. 

  12. 

  13. The upstream report for these XSS flaws in NuSOAP is located at the
    14. 

  14. following URL:
    15. 

  15. http://sourceforge.net/projects/nusoap/forums/forum/193579/topic/3834005
    16. 

  16. 

  17. This patch provides an interim fix for MantisBT users until upstream
    18. 

  18. makes a new release.
    19. 

  19. ---
    20. 

  20.  library/nusoap/class.wsdl.php |   16 ++++++++--------
    21. 

  21.  library/nusoap/nusoap.php     |   14 +++++++-------
    22. 

  22.  2 files changed, 15 insertions(+), 15 deletions(-)
    23. 

  23. 

  24. diff --git a/library/nusoap/class.wsdl.php b/library/nusoap/class.wsdl.php
    25. 

  25. index 6d2a693..7dcc307 100644
    26. 

  26. --- a/library/nusoap/class.wsdl.php
    27. 

  27. +++ b/library/nusoap/class.wsdl.php
    28. 

  28. @@ -842,9 +842,9 @@ class wsdl extends nusoap_base {
    29. 

  29.  		<body>
    30. 

  30.  		<div class=content>
    31. 

  31.  			<br><br>
    32. 

  32. -			<div class=title>'.$this->serviceName.'</div>
    33. 

  33. +			<div class=title>'.htmlentities($this->serviceName).'</div>
    34. 

  34.  			<div class=nav>
    35. 

  35. -				<p>View the <a href="'.$PHP_SELF.'?wsdl">WSDL</a> for the service.
    36. 

  36. +				<p>View the <a href="'.htmlentities($PHP_SELF).'?wsdl">WSDL</a> for the service.
    37. 

  37.  				Click on an operation name to view it&apos;s details.</p>
    38. 

  38.  				<ul>';
    39. 

  39.  				foreach($this->getOperations() as $op => $data){
    40. 

  40. @@ -854,21 +854,21 @@ class wsdl extends nusoap_base {
    41. 

  41.  				    <a href='#' onclick='popout()'><font color='#ffffff'>Close</font></a><br><br>";
    42. 

  42.  				    foreach($data as $donnie => $marie){ // loop through opdata
    43. 

  43.  						if($donnie == 'input' || $donnie == 'output'){ // show input/output data
    44. 

  44. -						    $b .= "<font color='white'>".ucfirst($donnie).':</font><br>';
    45. 

  45. +						    $b .= "<font color='white'>".htmlentities(ucfirst($donnie)).':</font><br>';
    46. 

  46.  						    foreach($marie as $captain => $tenille){ // loop through data
    47. 

  47.  								if($captain == 'parts'){ // loop thru parts
    48. 

  48. -								    $b .= "&nbsp;&nbsp;$captain:<br>";
    49. 

  49. +								    $b .= "&nbsp;&nbsp;".htmlentities($captain).":<br>";
    50. 

  50.  					                //if(is_array($tenille)){
    51. 

  51.  								    	foreach($tenille as $joanie => $chachi){
    52. 

  52. -											$b .= "&nbsp;&nbsp;&nbsp;&nbsp;$joanie: $chachi<br>";
    53. 

  53. +											$b .= "&nbsp;&nbsp;&nbsp;&nbsp;".htmlentities($joanie).": ".htmlentities($chachi)."<br>";
    54. 

  54.  								    	}
    55. 

  55.  					        		//}
    56. 

  56.  								} else {
    57. 

  57. -								    $b .= "&nbsp;&nbsp;$captain: $tenille<br>";
    58. 

  58. +								    $b .= "&nbsp;&nbsp;".htmlentities($captain).": ".htmlentities($tenille)."<br>";
    59. 

  59.  								}
    60. 

  60.  						    }
    61. 

  61.  						} else {
    62. 

  62. -						    $b .= "<font color='white'>".ucfirst($donnie).":</font> $marie<br>";
    63. 

  63. +						    $b .= "<font color='white'>".htmlentities(ucfirst($donnie)).":</font> ".htmlentities($marie)."<br>";
    64. 

  64.  						}
    65. 

  65.  				    }
    66. 

  66.  					$b .= '</div>';
    67. 

  67. @@ -1935,4 +1935,4 @@ class wsdl extends nusoap_base {
    68. 

  68.  	} 
    69. 

  69.  }
    70. 

  70.  
    71. 

  71. -?>
    72. 

  72. \ No newline at end of file
    73. 

  73. +?>
    74. 

  74. diff --git a/library/nusoap/nusoap.php b/library/nusoap/nusoap.php
    75. 

  75. index 4973532..10750aa 100644
    76. 

  76. --- a/library/nusoap/nusoap.php
    77. 

  77. +++ b/library/nusoap/nusoap.php
    78. 

  78. @@ -5424,9 +5424,9 @@ class wsdl extends nusoap_base {
    79. 

  79.  		<body>
    80. 

  80.  		<div class=content>
    81. 

  81.  			<br><br>
    82. 

  82. -			<div class=title>'.$this->serviceName.'</div>
    83. 

  83. +			<div class=title>'.htmlentities($this->serviceName).'</div>
    84. 

  84.  			<div class=nav>
    85. 

  85. -				<p>View the <a href="'.$PHP_SELF.'?wsdl">WSDL</a> for the service.
    86. 

  86. +				<p>View the <a href="'.htmlentities($PHP_SELF).'?wsdl">WSDL</a> for the service.
    87. 

  87.  				Click on an operation name to view it&apos;s details.</p>
    88. 

  88.  				<ul>';
    89. 

  89.  				foreach($this->getOperations() as $op => $data){
    90. 

  90. @@ -5436,21 +5436,21 @@ class wsdl extends nusoap_base {
    91. 

  91.  				    <a href='#' onclick='popout()'><font color='#ffffff'>Close</font></a><br><br>";
    92. 

  92.  				    foreach($data as $donnie => $marie){ // loop through opdata
    93. 

  93.  						if($donnie == 'input' || $donnie == 'output'){ // show input/output data
    94. 

  94. -						    $b .= "<font color='white'>".ucfirst($donnie).':</font><br>';
    95. 

  95. +						    $b .= "<font color='white'>".htmlentities(ucfirst($donnie)).':</font><br>';
    96. 

  96.  						    foreach($marie as $captain => $tenille){ // loop through data
    97. 

  97.  								if($captain == 'parts'){ // loop thru parts
    98. 

  98. -								    $b .= "&nbsp;&nbsp;$captain:<br>";
    99. 

  99. +								    $b .= "&nbsp;&nbsp;".htmlentities($captain).":<br>";
    100. 

  100.  					                //if(is_array($tenille)){
    101. 

  101.  								    	foreach($tenille as $joanie => $chachi){
    102. 

  102. -											$b .= "&nbsp;&nbsp;&nbsp;&nbsp;$joanie: $chachi<br>";
    103. 

  103. +											$b .= "&nbsp;&nbsp;&nbsp;&nbsp;".htmlentities($joanie).": ".htmlentities($chachi)."<br>";
    104. 

  104.  								    	}
    105. 

  105.  					        		//}
    106. 

  106.  								} else {
    107. 

  107. -								    $b .= "&nbsp;&nbsp;$captain: $tenille<br>";
    108. 

  108. +								    $b .= "&nbsp;&nbsp;".htmlentities($captain).": ".htmlentities($tenille)."<br>";
    109. 

  109.  								}
    110. 

  110.  						    }
    111. 

  111.  						} else {
    112. 

  112. -						    $b .= "<font color='white'>".ucfirst($donnie).":</font> $marie<br>";
    113. 

  113. +						    $b .= "<font color='white'>".htmlentities(ucfirst($donnie)).":</font> ".htmlentities($marie)."<br>";
    114. 

  114.  						}
    115. 

  115.  				    }
    116. 

  116.  					$b .= '</div>';
    117. 

  117. -- 
    118. 

  118. 1.7.2.2
    119.