Persistent XSS in Koha 3.2203000, you could save a list in your account with a Script tag for e.g. <script>alert(1)</script>, when you click share the list, the alert window appears.
Created attachment 51822 [details] XSS PoC
*** Bug 16598 has been marked as a duplicate of this bug. ***
Created attachment 51824 [details] [review] Bug 16599: Fix XSS in opac-shareshelf.pl Test plan: - Create a list with the name "<script>alert(1)</script>" - On the shelf list, click on share => Without this patch you will see the JS alert => With this patch applied you won't see it Reported by Kaybee at Dionach
Created attachment 51825 [details] [review] Bug 16599: Fix other potentials XSS for shelfname
Created attachment 51827 [details] [review] Bug 16599: Fix XSS in opac-shareshelf.pl Test plan: - Create a list with the name "<script>alert(1)</script>" - On the shelf list, click on share => Without this patch you will see the JS alert => With this patch applied you won't see it Reported by Kaybee at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 51828 [details] [review] Bug 16599: Fix other potentials XSS for shelfname Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Also just to advise the vulnerability appears in the 'download list' as well. Save a list as before and click download list.
(In reply to Kaybee from comment #7) > Also just to advise the vulnerability appears in the 'download list' as > well. Save a list as before and click download list. May be you have fixed, but I've added it to ensure it's tested correctly.
(In reply to Kaybee from comment #8) > (In reply to Kaybee from comment #7) > > Also just to advise the vulnerability appears in the 'download list' as > > well. Save a list as before and click download list. > > May be you have fixed, but I've added it to ensure it's tested correctly. Yes thanks, it's not explicitly noted in the test plan, but I fixed this one too.
Cheers.
Created attachment 51865 [details] [review] Bug 16599: Fix XSS in opac-shareshelf.pl Test plan: - Create a list with the name "<script>alert(1)</script>" - On the shelf list, click on share => Without this patch you will see the JS alert => With this patch applied you won't see it Reported by Kaybee at Dionach Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 51866 [details] [review] Bug 16599: Fix other potentials XSS for shelfname Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to Master - Should be in the November 2016 release. Thanks
Pushed to 3.20.x will be in 3.20.11 (Is in 3.22.7 already)
(In reply to Chris Cormack from comment #14) > (Is in 3.22.7 already) No, but it will be in 3.22.8