Bug 14360

Summary:	XSS Injection point
Product:	Koha	Reporter:	Vincent <vincent.junik>
Component:	OPAC	Assignee:	Aleisha Amohia <aleisha>
Status:	CLOSED FIXED	QA Contact:	Chris Cormack <chris>
Severity:	major
Priority:	P5 - low	CC:	fridolin.somers, gmc, jonathan.druart, kyle, liz, m.de.rooy, mtj, tomascohen, vincent.junik
Version:	unspecified
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	Small patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:
Circulation function:
Attachments:	Bug 14360: Unescaped variable causes alert Bug 14360: Unescaped variable causes alert pop-up [SIGNED OFF] Bug 14360: Unescaped variable causes alert [SIGNED OFF] Bug 14360: Unescaped variable causes alert pop-up [PASSED QA] Bug 14360: Unescaped variable causes alert [PASSED QA] Bug 14360: Unescaped variable causes alert pop-up

Description Vincent 2015-06-07 14:51:00 UTC

Got injection point in some query like :

opac-authorities-home.pl?op=do_search&resultsperpage=1"><script>alert(document.cookie)</script>

But another funny is to create a list with a js code in the name and it will be readen on delet like :

<script>alert(document.cookie);</script>

I didn't try all the $ for injection point but i think you should bullet proof it with an sqlmap on all of them. And to test some scan with kali's tool or ask for someone who can use them to bullet proof it. 

Regards.

Vincent.

Comment 1 Katrin Fischer 2015-06-07 19:59:55 UTC

Vincent helped me out on IRC with a link that makes the first problem visible on Bywater's demo installation (3.19...):

http://catalog.bywatersolutions.com/cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Comment 2 Katrin Fischer 2015-06-07 20:17:26 UTC

For the second issue:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'

Tested on current master.

Comment 3 Aleisha Amohia 2015-06-08 04:57:02 UTC Comment hidden (obsolete)

Created attachment 39981 [details] [review]
Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Comment 4 Aleisha Amohia 2015-06-09 04:25:04 UTC Comment hidden (obsolete)

Created attachment 40009 [details] [review]
Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Comment 5 Katrin Fischer 2015-06-09 21:38:05 UTC Comment hidden (obsolete)

Created attachment 40045 [details] [review]
[SIGNED OFF] Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 6 Katrin Fischer 2015-06-09 21:38:18 UTC Comment hidden (obsolete)

Created attachment 40046 [details] [review]
[SIGNED OFF] Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Comment 7 Katrin Fischer 2015-06-09 21:42:38 UTC

Can we get some QA on this next please? :)

Comment 8 Kyle M Hall (khall) 2015-06-10 13:16:14 UTC

Created attachment 40066 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Comment 9 Kyle M Hall (khall) 2015-06-10 13:16:21 UTC

Created attachment 40067 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Comment 10 Tomás Cohen Arazi (tcohen) 2015-06-11 13:18:01 UTC

Patches pushed to master.

Thanks Aleisha!

Comment 11 Chris Cormack 2015-06-11 20:11:47 UTC

Pushed to 3.20.x will be in 3.20.1

Comment 12 Chris Cormack 2015-06-17 22:32:50 UTC

Mason and liz you might want to take a look at this one

Comment 13 Liz Rea 2015-06-19 04:07:42 UTC

I have this in my branch for 3.18. I still can't seem to get my keys to work for git.koha-community.org.

Comment 14 Liz Rea 2015-06-23 01:57:20 UTC

Pushed to 3.18.x will be in 3.18.08

Comment 15 Fridolin Somers 2015-06-23 09:42:56 UTC

Pushed to 3.14.x, will be in 3.14.16