Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks
Summary: Koha is vulnerable to Cross-Frame Scripting (XFS) attacks
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: master
Hardware: All All
: P5 - low critical (vote)
Assignee: Kyle M Hall
QA Contact: Testopia
URL:
Keywords:
: 11778 (view as bug list)
Depends on:
Blocks: 16210
  Show dependency treegraph
 
Reported: 2015-11-02 17:11 UTC by Kyle M Hall
Modified: 2019-06-27 09:24 UTC (History)
12 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks (4.12 KB, patch)
2015-11-02 17:12 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks (4.20 KB, patch)
2015-11-03 19:12 UTC, Chris Cormack
Details | Diff | Splinter Review
[PASSED QA] Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks (4.21 KB, patch)
2015-11-08 21:27 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 15111: Change X-Frame-Options with SAMEORIGIN (1.17 KB, patch)
2015-11-13 08:23 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 15111: Change X-Frame-Options with SAMEORIGIN (1.23 KB, patch)
2015-12-07 12:17 UTC, Kyle M Hall
Details | Diff | Splinter Review
Bug 15111: Do not include the antiClickjack legacy browser trick for greybox (6.22 KB, patch)
2016-02-22 09:28 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks (4.28 KB, patch)
2016-02-29 11:10 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 15111: Change X-Frame-Options with SAMEORIGIN (1.30 KB, patch)
2016-02-29 11:11 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 15111: Do not include the antiClickjack legacy browser trick for greybox (6.29 KB, patch)
2016-02-29 11:11 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks (4.33 KB, patch)
2016-03-03 19:20 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 15111: Change X-Frame-Options with SAMEORIGIN (1.35 KB, patch)
2016-03-03 19:20 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 15111: Do not include the antiClickjack legacy browser trick for greybox (6.35 KB, patch)
2016-03-03 19:20 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall 2015-11-02 17:11:03 UTC
Web pages that can be embedded in frames are vulnerable to cross-frame scripting attacks. Cross-frame scripting is a type of phishing attack that involves instructions to an unsuspecting user to follow a specific link to update confidential information in an online application. Because the link leads to a legitimate page from the online application that is embedded in a frame hosted by the attackers' server, the attackers can capture all the information that the user enters.

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
Comment 1 Kyle M Hall 2015-11-02 17:12:45 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2015-11-02 17:49:59 UTC
*** Bug 11778 has been marked as a duplicate of this bug. ***
Comment 3 Chris Cormack 2015-11-03 19:12:31 UTC Comment hidden (obsolete)
Comment 4 Katrin Fischer 2015-11-04 00:35:21 UTC
Can I please get a test plan for this?
What are the side effects? Does it mean Koha can generally not be run in a frame?
Comment 5 Kyle M Hall 2015-11-05 14:12:24 UTC
(In reply to Katrin Fischer from comment #4)
> Can I please get a test plan for this?
> What are the side effects? Does it mean Koha can generally not be run in a
> frame?

To test: Browse to http://1dn.eu/iframe.asp?url=URL where URL is the url to your Koha server. It your server is vulnerable to XFS attacks you will be able to see it in the frame, if it is empty, your site is safe from XFS attacks.

You can also test with sites like google.com and yahoo.com. Generally any site that allows you to log in is especially vulnerable to XFS attacks as an attacker can use the frame to capture your username and password as you type it.

Yes, that is correct.
Comment 6 Katrin Fischer 2015-11-05 14:14:44 UTC
It makes sense to follow security guidelines - no question there. But shoudl we put a warning in the release notes? It might be that people have used iframes to integrate the OPAC into their websites.
Comment 7 Kyle M Hall 2015-11-05 14:16:37 UTC
(In reply to Katrin Fischer from comment #6)
> It makes sense to follow security guidelines - no question there. But shoudl
> we put a warning in the release notes? It might be that people have used
> iframes to integrate the OPAC into their websites.

That sounds fine by me!
Comment 8 Katrin Fischer 2015-11-05 14:18:39 UTC
Only one problem for me - I don't have a Koha installation that is not "localhost" that I can test with - so I can't test with the website you recommended.
Comment 9 Kyle M Hall 2015-11-06 11:58:27 UTC
(In reply to Katrin Fischer from comment #8)
> Only one problem for me - I don't have a Koha installation that is not
> "localhost" that I can test with - so I can't test with the website you
> recommended.

Have you tried it? That should not be a problem! I was able to test my own local installation using that tool.
Comment 10 Katrin Fischer 2015-11-08 21:27:26 UTC Comment hidden (obsolete)
Comment 11 Katrin Fischer 2015-11-08 21:27:48 UTC
Please read comments before pushing - might need a note in the Release notes.
Comment 12 Jonathan Druart 2015-11-13 08:17:24 UTC
Yes, it could have worked if we didn't use iframe :)
But we do!
To reproduce:
- modify a record in a batch (tools/batch_record_modification.pl)
- click on preview marc
=> With this patch you will get a blank page.
Comment 13 Katrin Fischer 2015-11-13 08:19:50 UTC
Good catch!
Comment 14 Jonathan Druart 2015-11-13 08:23:30 UTC Comment hidden (obsolete)
Comment 15 Liz Rea 2015-11-17 23:55:34 UTC
This seems still broken for greybox things, example in the label creator when you are exporting a batch, the greybox doesn't load - it performs it's fallback but I don't think that's how we want it to be.
Comment 16 Jonathan Druart 2015-11-25 13:03:21 UTC
It works for the record preview because it does not include doc-head-close.inc.
Comment 17 Kyle M Hall 2015-12-07 12:17:52 UTC Comment hidden (obsolete)
Comment 18 Jonathan Druart 2015-12-08 17:21:39 UTC
Kyle, it does not seem to work, see comment 15.
Comment 19 Kyle M Hall 2015-12-09 17:21:24 UTC
(In reply to Jonathan Druart from comment #18)
> Kyle, it does not seem to work, see comment 15.

Ack! Missed that!
Comment 20 Chris Cormack 2016-02-22 00:20:48 UTC
Anyone have chance to finish this off?
Comment 21 Jonathan Druart 2016-02-22 09:28:16 UTC Comment hidden (obsolete)
Comment 22 Katrin Fischer 2016-02-28 09:42:16 UTC
Kyle and Jonathan - could you sign off on each other's patches maybe?
Comment 23 Jonathan Druart 2016-02-29 11:10:50 UTC Comment hidden (obsolete)
Comment 24 Jonathan Druart 2016-02-29 11:11:03 UTC Comment hidden (obsolete)
Comment 25 Jonathan Druart 2016-02-29 11:11:11 UTC Comment hidden (obsolete)
Comment 26 Jonathan Druart 2016-03-03 18:20:56 UTC
This is a security bug guys...
Comment 27 Chris Cormack 2016-03-03 19:20:14 UTC
Created attachment 48646 [details] [review]
Bug 15111 - Koha is vulnerable to Cross-Frame Scripting (XFS) attacks

Web pages that can be embedded in frames are vulnerable to cross-frame
scripting attacks. Cross-frame scripting is a type of phishing attack
that involves instructions to an unsuspecting user to follow a specific
link to update confidential information in an online application.
Because the link leads to a legitimate page from the online application
that is embedded in a frame hosted by the attackers' server, the
attackers can capture all the information that the user enters.

https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 28 Chris Cormack 2016-03-03 19:20:29 UTC
Created attachment 48647 [details] [review]
Bug 15111: Change X-Frame-Options with SAMEORIGIN

There are some places where frames are used, the greybox JS plugin for
instance.

We need either to allow them from Koha or replace this plugin.
The easier for now is to switch the value from DENY with SAMEORIGIN.

Test plan:
- modify a record in a batch (tools/batch_record_modification.pl)
- click on preview marc
=> With only the previous patch you will get a blank page.
=> With this patch apply, it will work as expected.

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 29 Chris Cormack 2016-03-03 19:20:49 UTC
Created attachment 48648 [details] [review]
Bug 15111: Do not include the antiClickjack legacy browser trick for greybox

Most of the scripts called via greybox (which uses iframe) don't include
doc-head-close. But some do.
This patch adds a popup parameter for these templates, not to include
the legacy browser trick and avoid the replacement of the location.

Test plan:
1/ Export patroncard and label
2/ translate itemtypes
3/ click on a idref link at the OPAC

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 30 Jonathan Druart 2016-03-11 08:42:24 UTC
Any QAers around?
Comment 31 Jonathan Druart 2016-03-14 15:30:47 UTC
Skipping QA.
Comment 32 Kyle M Hall 2016-03-14 16:57:48 UTC
Pushed to master! Will be in Koha 16.05! Thanks for the followups Jonathan!
Comment 33 Jonathan Druart 2016-04-06 14:16:32 UTC
Well, we have a problem.
After reading this https://www.owasp.org/images/0/0e/OWASP_AppSec_Research_2010_Busting_Frame_Busting_by_Rydstedt.pdf it seems that it is not possible not to be vulnerable to XFS and render something with JS disabled...
Comment 34 Julian Maurice 2016-04-22 08:58:25 UTC
Patches pushed to 3.22.x, will be in 3.22.6