Bug 10657 - use of Storable for OPAC search history cookie dangerous
Summary: use of Storable for OPAC search history cookie dangerous
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: Main
Hardware: All All
: P5 - low blocker (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 10338
  Show dependency treegraph
 
Reported: 2013-07-29 16:06 UTC by Galen Charlton
Modified: 2019-06-27 09:24 UTC (History)
1 user (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Galen Charlton 2013-07-29 16:06:45 UTC
placeholder
Comment 1 Galen Charlton 2013-07-29 22:50:15 UTC
When EnableOpacSearchHistory system preference is enabled, Koha stores recent search history for anonymous OPAC sessions in a cookie called KohaOpacRecentSearches.  In particular, it used to use the Storable Perl module to serialize the array of hashrefs representing the recent searches.

However, the documentation for Storable strongly recommends [1] that data to be deserialized *not* come from untrusted sources -- and cookies cannot be considered trustworthy, as most web browsers (to say nothing of curl) allow the user to modify them.  There is a theoretical possibility that a modification to the KohaOpacRecentSearches cookie could result in the execution of unauthorized code with the privileges of the Apache backend process.

The 29 July 2013 security update resolves the security issuing by replacing use of the Storable module with the JSON, which doesn't by default serialize blessed references and does not attempt to deserialize and execute coderefs.  The payload of the cookie is checked for JSON-correctness and is ignored if it doesn't contain a valid (double-URI-encoded) JSON object.  In particularly, any old Storable-based cookies are silently ignored.

[1] http://perldoc.perl.org/Storable.html#SECURITY-WARNING
Comment 2 Galen Charlton 2013-07-29 22:51:28 UTC
Fix released: http://koha-community.org/security-release-july-2013/