Refactor page doesn't escape user input

[mikestockdale]

Similar to #1526

---

Vulnerability Report for JVN#06704866 (begins here)

This vulnerability was discovered and reported by the below
researcher.

Takeshi Kaneko of GMO Cybersecurity by Ierae, Inc.

• Vulnerability ID:
  JVN#06704866

• Type of Vulnerability:
  CWE-79
  FitNesse contains a reflected cross-site scripting vulnerability

• Affected Product/Version:
  FitNesse 20240707

• Reproduction settings and environment:
  The vulnerability is exploitable with the default settings.

• Reproduction Steps:

  1. Download "fitnesse-standalone.jar" which is the latest version "20240707"
     of FitNesse from https://fitnesse.org/FitNesseDownload.html.

  2. Run "java -jar fitnesse-standalone.jar -p 3000" to start FitNesse.

  3. Access one of the following URLs:
     http://localhost:3000/?responder=refactor&searchString="><script>alert(location)</script>
     http://localhost:3000/?responder=refactor&replacementString="><script>alert(location)</script>」

  4. Confirm that JavaScript "alert(location)" is executed and the XSS occurs.

  [Cause of vulnerability]

  • This is caused by outputting user input values ​​without HTML escaping.
  • Corresponding code:
    • First searchString
      https://github.com/unclebob/fitnesse/blob/20240707/src/fitnesse/resources/templates/refactorForm.vm#L7
    • Second searchString
      https://github.com/unclebob/fitnesse/blob/20240707/src/fitnesse/resources/templates/refactorForm.vm#L28
    • First replacementString
      https://github.com/unclebob/fitnesse/blob/20240707/src/fitnesse/resources/templates/refactorForm.vm#L11
    • Second replacementString
      https://github.com/unclebob/fitnesse/blob/20240707/src/fitnesse/resources/templates/refactorForm.vm#L32

• Possible Impacts:
  Same impact as general reflected XSS

• Workaround:
  Disable the responder "refactor" in the configuration file.
  Reference: https://fitnesse.org/FitNesse/UserGuide/AdministeringFitNesse/ConfigurationFile.html

• Proof-of-concept code:
  None

• CVSS Scores:
  CVSSv3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/BS:6.1

---

Vulnerability Report for JVN#06704866 (ends here)