Bug 19034 - XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Summary: XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories ...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Amit Gupta
QA Contact: Tomás Cohen Arazi (tcohen)
URL:
Keywords:
Depends on:
Blocks: 14568
  Show dependency tree / graph
 
Reported: 2017-08-04 04:27 UTC by Amit Gupta
Modified: 2019-10-14 19:56 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Bug 19034 - XSS Flaws in Patron categories pages (1.18 KB, patch)
2017-08-04 05:17 UTC, Amit Gupta 		Details | Diff | Splinter Review
Bug 19034 - XSS Flaws in Cities (1.05 KB, patch)
2017-08-04 05:18 UTC, Amit Gupta 		Details | Diff | Splinter Review
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration (1.39 KB, patch)
2017-08-04 05:19 UTC, Amit Gupta 		Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Patron categories pages (1.23 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Cities (1.10 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Z39.50/SRU servers administration (1.45 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 19034: (followup) Fix letters.tt XSS flaw (992 bytes, patch)
2017-08-07 14:27 UTC, Tomás Cohen Arazi (tcohen) 		Details | Diff | Splinter Review
Bug 19034: (followup 2) Fix letters.tt XSS flaw (1.05 KB, patch)
2017-08-15 16:26 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Show Obsolete (3) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-04 04:27:03 UTC 
XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Comment 1 Amit Gupta 2017-08-04 05:17:35 UTC 
Created attachment 65485 [details] [review]
Bug 19034 - XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-04 05:18:40 UTC 
Created attachment 65486 [details] [review]
Bug 19034 - XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.
Comment 3 Amit Gupta 2017-08-04 05:19:39 UTC 
Created attachment 65487 [details] [review]
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.
Comment 4 Katrin Fischer 2017-08-04 05:23:43 UTC 
Hi Amit, thx for reporting and fixing this! Please file security relevant bugs in the 'Koha security' Product, that is not generally visible until the bug is properly fixed.
Comment 5 Amit Gupta 2017-08-04 05:26:35 UTC 
Hi Katrin,

Thanks!!
Comment 6 Tomás Cohen Arazi (tcohen) 2017-08-07 14:22:32 UTC 
Created attachment 65559 [details] [review]
Bug 19034: XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 7 Tomás Cohen Arazi (tcohen) 2017-08-07 14:22:39 UTC 
Created attachment 65560 [details] [review]
Bug 19034: XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Tomás Cohen Arazi (tcohen) 2017-08-07 14:22:48 UTC 
Created attachment 65561 [details] [review]
Bug 19034: XSS Flaws in Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 9 Tomás Cohen Arazi (tcohen) 2017-08-07 14:27:55 UTC 
Created attachment 65562 [details] [review]
Bug 19034: (followup) Fix letters.tt XSS flaw

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 10 Amit Gupta 2017-08-07 14:29:33 UTC 
Thanks Tomas i am working on some other XSS issues also.
Comment 11 Tomás Cohen Arazi (tcohen) 2017-08-07 14:50:34 UTC 
(In reply to Amit Gupta from comment #10)
> Thanks Tomas i am working on some other XSS issues also.

I've patched letter.tt here. bGreat job finding them!
Comment 12 Jonathan Druart 2017-08-15 16:26:36 UTC 
Created attachment 66028 [details] [review]
Bug 19034: (followup 2) Fix letters.tt XSS flaw
Comment 13 Jonathan Druart 2017-08-29 15:07:17 UTC 
Pushed to master for 17.11, thanks to everybody involved!
Comment 14 Fridolin Somers 2017-09-05 12:44:52 UTC 
Pushed to 17.05.x, is in 17.05.03
Comment 15 Katrin Fischer 2017-09-07 06:15:12 UTC 
This patches have been pushed to 16.11.x and are in 16.11.11.
Comment 16 Mason James 2017-09-20 02:37:57 UTC 
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)