The following issues were identified, Koha was installed on ubuntu 16.04 and mySQL with default configuration: Vulnerability Type: Reflected Cross Site Scripting Affected Product: koha library system Tested Version: 17.05.02 Discovered by: Jiaky Ooi Affected URL: /cgi-bin/koha/members/member.pl Affected Parameter: searchmember Proof of Concept: Full link for PoC : /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script> Vulnerability Type: Stored Cross Site Scripting Affected Product: koha library system Tested Version: 17.05.02 Discovered by: Jiaky Ooi Affected URL: 1) /cgi-bin/koha/acqui/supplier.pl?op=enter 2) /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] 3) /cgi-bin/koha/serials/subscription-add.pl Affected Parameter: 1) company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes 2) borrower_message 3) Internalnotes, notes Please be aware that we will publish these vulnerability on the disclosure date when agreed. Please reserve CVE number for this vulnerability by contacting Mitre. Further information can be found at https://cve.mitre.org/cve/request_id.html I will be happy to provide further information on this vulnerability, including the mechanisms by which it was identified, and any pertinent technical information if required. Many thanks _________________________________________________________ Jiaky Ooi | Consultant Oxford +44 (0)1865 877 830 Dubai +971 (0)4 427 0428 London +44 (0)203 5983740 New York +1 646-781-7580 E-Mail jiaky.ooi@dionach.com Web www.dionach.com ®
Created attachment 65927 [details] [review] Bug 19086 XSS in members/member.pl To test 1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script> 2/ Notice js is executed 3/ Apply patch, reload 4/ js is now escaped
Created attachment 65929 [details] [review] Bug 19086 Stored XSS in circulation.pl 1/ To test add a message to a borrower that contains js 2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] where number is the borrowernumber of the borrower you set the message for 3/ Notice js is execute 4/ Apply patch, reload, js is escaped
2 left to go, /cgi-bin/koha/acqui/supplier.pl?op=enter and /cgi-bin/koha/serials/subscription-add.pl I have to go out now tho, so hopefully someone else will grab those
Created attachment 65958 [details] [review] Bug 19086 XSS in members/member.pl Tested and work OK.
Hi Chris, I am able to execute the java script after applying the patch also. (circulation.pl)
If we are using HTML::Entities wil able to escape the js.
Created attachment 65960 [details] [review] Bug 19086 Stored XSS in circulation.pl Used HTML::Entities - Encode or decode strings with HTML entities. ******************************************************************** 1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>. xx - is a borrowernumber 2. Notice the java script is executed. 4. Apply patch. 5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>. xx - is a borrowernumber. 6. Notice it is no longer executed.
Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089) I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl Can you please provide us some screen shots.
Created attachment 65965 [details] [review] Bug 19086 Stored XSS in routing-lists.pl 1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 3. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 4. Notice it is no longer executed.
Created attachment 65966 [details] [review] Bug 19086 Stored XSS in readingrec.pl 1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 5. Notice it is no longer executed.
Created attachment 65967 [details] [review] Bug 19086 Stored XSS in notices.pl 1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 5. Notice it is no longer executed.
Created attachment 65968 [details] [review] Bug 19086 Stored XSS in maninvoice.pl 1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 5. Notice it is no longer executed.
Created attachment 65969 [details] [review] Bug 19086 Stored XSS in boraccount.pl 1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 5. Notice it is no longer executed.
Created attachment 65970 [details] [review] Bug 19086 Stored XSS in mancredit.pl 1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 2. Notice java script is execute. 3. Apply patch. 4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('XSS Payload')</script> xx is a borrowernumber 5. Notice it is no longer executed.
Amit the stored ones involve adding js to the database, if you see the test plan it is to do with adding js to a note then hitting the field. Different to passing js as a parameter.
Created attachment 65972 [details] [review] Bug 19086 Stored XSS in circulation.pl Test and work OK. I am moving others patches in new bug
Need to fix 2 more.
(In reply to Amit Gupta from comment #8) > Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089) > > I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl > > Can you please provide us some screen shots. Hi Amit, Apologies I am trying to reproduce this at the moment but my resources are at a different office. Please allow me up to 24 hours to provide you with an update. Best regards, Jiaky
Created attachment 65984 [details] [review] Bug 19086 Stored XSS in /cgi-bin/koha/acqui/supplier.pl?op=enter 1. To test - add a text in the field company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script 2. Save the page. 3. Notice js is execute 4. Apply patch and reload the js is escaped
Created attachment 65985 [details] [review] Bug 19086 Stored XSS in subscription-add.pl 1. To test - add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped
(In reply to jiakyooi95 from comment #18) > (In reply to Amit Gupta from comment #8) > > Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089) > > > > I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl > > > > Can you please provide us some screen shots. > > Hi Amit, > > Apologies I am trying to reproduce this at the moment but my resources are > at a different office. > > Please allow me up to 24 hours to provide you with an update. > > Best regards, > Jiaky I have fixed the remaining 2.
Created attachment 65986 [details] [review] Bug 19086 Stored XSS in supplier.pl Some changes in test case. ***************************** 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped
Created attachment 65987 [details] [review] Bug 19086 Stored XSS in subscription-add.pl To Test 1. Hit the page /cgi-bin/koha/serials/subscription-add.pl 2. Add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped
For subscription-detail I am not sure - people might have added html to the note fields on purpose to highlight some things in the OPAC more. With the html filter, this won't be permitted.
Created attachment 66058 [details] [review] [SIGNED OFF] Bug 19086 XSS in members/member.pl To test 1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script> 2/ Notice js is executed 3/ Apply patch, reload 4/ js is now escaped Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66059 [details] [review] [SIGNED OFF] Bug 19086 Stored XSS in circulation.pl 1/ To test add a message to a borrower that contains js 2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] where number is the borrowernumber of the borrower you set the message for 3/ Notice js is execute 4/ Apply patch, reload, js is escaped Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66060 [details] [review] [SIGNED OFF] Bug 19086 Stored XSS in supplier.pl 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66061 [details] [review] [SIGNED OFF] Bug 19086 Stored XSS in subscription-add.pl To Test 1. Hit the page /cgi-bin/koha/serials/subscription-add.pl 2. Add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66062 [details] [review] Bug 19086 - Follow-up - XSS in supplier.tt In preparation: Make sure you enter <script>alert("sth")</script> in all fields of a new vendor that are not validated and save. 1) Access vendor summary page. 2) Verify scripts are executed 3) Apply patch 4) Verify scripts are on longer executed This works in combination with the other patches for XSS on this bug.
Created attachment 66063 [details] [review] Bug 19086 - Follow-up - subscription-detail.pl Add script to the callnumber field on adding a subscription. Verify script is executed without this patch, but not with it.
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt [% name |html %]</a> › Update: [% name %] Forgot the second one here?
Created attachment 66433 [details] [review] Bug 19086 XSS in members/member.pl To test 1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script> 2/ Notice js is executed 3/ Apply patch, reload 4/ js is now escaped Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66434 [details] [review] Bug 19086 Stored XSS in circulation.pl 1/ To test add a message to a borrower that contains js 2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] where number is the borrowernumber of the borrower you set the message for 3/ Notice js is execute 4/ Apply patch, reload, js is escaped Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66435 [details] [review] Bug 19086 Stored XSS in supplier.pl 1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter 2. Add a text in the field company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script 3. Save the page. 4. Notice js is execute 5. Apply patch and reload the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66436 [details] [review] Bug 19086 Stored XSS in subscription-add.pl To Test 1. Hit the page /cgi-bin/koha/serials/subscription-add.pl 2. Add a text in the field Public note and Nonpublic note that contains js (Internalnotes, notes) 2. Save the page. 3. Notice js is execute 4. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66437 [details] [review] Bug 19086 - Follow-up - XSS in supplier.tt In preparation: Make sure you enter <script>alert("sth")</script> in all fields of a new vendor that are not validated and save. 1) Access vendor summary page. 2) Verify scripts are executed 3) Apply patch 4) Verify scripts are on longer executed This works in combination with the other patches for XSS on this bug. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66438 [details] [review] Bug 19086 - Follow-up - subscription-detail.pl Add script to the callnumber field on adding a subscription. Verify script is executed without this patch, but not with it. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Hello, Just a quick question please. As the last comment made on this thread was on the 25th August, and this has been marked as Passed QA, will there be a CVE number assigned to this vulnerability please? Best regards, Jiaky
(In reply to Jiaky Ooi from comment #38) > As the last comment made on this thread was on the 25th August, and this has > been marked as Passed QA, will there be a CVE number assigned to this > vulnerability please? Hello Jiaky, No, no CVE number will be assigned. The patch is going to be pushed to master and stable branches simultaneously around September 22th.
These patches have been pushed to 16.11.x and will be in 16.11.12.
These patches have been pushed to 17.05.x and are in 17.05.04.
*** Bug 19362 has been marked as a duplicate of this bug. ***
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 16.05.x, for 16.05.17 release
Interesting thing: on bug 13618 it was decided to not escape the patron's messages. So maybe this will be be considered as a bug by some libraries.