Created attachment 34921 [details] Scan Acunetix accunetix made with text koha version: 3.18.02 s.o : Ubuntu Server *********************************************** scan start ****************************** CVSS - Access Vector: Network - Access Complexity: Medium - Authentication: None - Confidentiality Impact: None - Integrity Impact: Partial - Availability Impact: None CWE-79 CWE Affected items /cgi-bin/koha/opac-downloadshelf.pl /cgi-bin/koha/opac-shelves.pl /cgi-bin/koha/opac-topissues.pl
example: http://koha.opengeekservice.cl/cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves
example http://koha.opengeekservice.cl/cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E
example http://koha.opengeekservice.cl//cgi-bin/koha/opac-topissues.pl?branch=BC&do_it=1&itemtype=MN&limit=10&timeLimit=3%3Cscript%3Eprompt(924513)%3C/script%3E
Thanks Carlos, will investigate further. You are running the latest version of master (or 3.18.x or 3.16.x) eh?
I will work on this tonight, unless someone beats me to it. carlos you might want to try to fix it. It will be a missing |html or |uri in the template file.
we are using 3.18.02 en ubuntu server
Ah yes, it's only in the bootstrap theme. These errors crept in with the bootstrap templates. So anything running bootstrap (3.16.x up) will be vulnerable. Ill do a patch tonight. Thanks again Carlos, please do report if you spot anything else.
Created attachment 34925 [details] [review] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup.
I wasn't able to replicate the 3rd case, but I think I sorted the first two. Cheers, Liz
Created attachment 34926 [details] [review] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup. You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't have permission to view them. Signed-off-by: Chris <chris@bigballofwax.co.nz> Fixes the two listed problems
I can recreate the third issue. You have to have some items with items.issue not null. and then a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E Will do it. Working on a patch now
Created attachment 34927 [details] [review] Bug 13510 : Fixing the third XSS issue To test 1/ Make sure you have some items in your database, that have values in items.issue If nessecary do something like UPDATE items SET issues = 10 WHERE itemnumber=somenumber 2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E 3/ Notice you will get a prompt 4/ Apply patch 5/ Test again
Created attachment 34928 [details] [review] [SIGNED OFF] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup. You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't have permission to view them. Signed-off-by: Chris <chris@bigballofwax.co.nz> Fixes the two listed problems Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Confirmed patch fixes the problem.
Created attachment 34929 [details] [review] [SIGNED OFF] Bug 13510 : Fixing the third XSS issue To test 1/ Make sure you have some items in your database, that have values in items.issue If nessecary do something like UPDATE items SET issues = 10 WHERE itemnumber=somenumber 2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E 3/ Notice you will get a prompt 4/ Apply patch 5/ Test again Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 34930 [details] [review] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup. You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't have permission to view them. Signed-off-by: Chris <chris@bigballofwax.co.nz> Fixes the two listed problems Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Confirmed patch fixes the problem. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 34931 [details] [review] [PASSED QA] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves A specially crafted url causes XSS in Koha To test: cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves These should cause a popup without the patch. With the patch, no popup. You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't have permission to view them. Signed-off-by: Chris <chris@bigballofwax.co.nz> Fixes the two listed problems Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Confirmed patch fixes the problem. Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Created attachment 34932 [details] [review] [PASSED QA] Bug 13510 : Fixing the third XSS issue To test 1/ Make sure you have some items in your database, that have values in items.issue If nessecary do something like UPDATE items SET issues = 10 WHERE itemnumber=somenumber 2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E 3/ Notice you will get a prompt 4/ Apply patch 5/ Test again Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Patches pushed to master. Thanks Liz and Chris!
Pushed to 3.18.x will be in 3.18.3
Pushed to 3.14.x will be in 3.14.13
Pushed to 3.16.x will be in 3.16.7