A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. eg This GET request, providing the attacker is authenticated, will delete the search assigned with the value 100, even if this search was not their own: https://localhost/cgi-bin/koha/opac-search-history.pl?action=delete&id=100 Please confirm this issue and credit Alex Middleton at Dionach in any security advisory. Thanks.
Created attachment 51823 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach
Created attachment 51826 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 52494 [details] [review] Bug 16593: Do not allow patrons to delete search history of others patrons A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. To reproduce: Login with patron A launch a search Note the id generated for this search history: select id from search_history order by id desc limit 1; Login with patron B Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID> Note that the row is deleted in the DB Test plan Confirm that this patch fixes the issue. The same test can be made at the staff interface Reported by Alex Middleton at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Pushed to master for 16.11, thanks Jonathan!
Pushed in 16.05. Will be in 16.05.02.
Pushed to 3.20.x will be in 3.20.14
Patch pushed to 3.22.x, will be in 3.22.10