Stored XSS in multiple scripts
Stored XSS issue in 1. /cgi-bin/koha/admin/oai_sets.pl?op=new 2. /cgi-bin/koha/admin/items_search_fields.pl
Created attachment 65997 [details] [review] Bug 19108 - Stored XSS in oai_sets.pl To Test 1. Hit the page /cgi-bin/koha/admin/oai_sets.pl 2. Click on New set 3. Add a text in the field setSpec, setName that contains js 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped
Created attachment 65998 [details] [review] Bug 19108 - Stored XSS in items_search_fields.pl To Test 1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl 2. Add a text in the field Name and Label that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Fixed for new and edit page
Created attachment 65999 [details] [review] Bug 19108 - Stored XSS in classsources.pl Found more page: /cgi-bin/koha/admin/classsources.pl ******************** Fixed for both Classification sources & Classification filing rules To Test 1. first case classification source: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_source second case classification filing rules: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped
Created attachment 66000 [details] [review] Bug 19108 - Stored XSS in authtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped
Created attachment 66001 [details] [review] Bug 19108 - Stored XSS in fieldmapping.pl To Test 1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl 2. Add a text in the field Field name that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped
Created attachment 66002 [details] [review] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl To Test 1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Click on Actions -> MARC structure 6. Apply patch and reload, the js is escaped Fixed for both the pages biblio_framework.pl and marctagstructure.pl
Created attachment 66079 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in oai_sets.pl To Test 1. Hit the page /cgi-bin/koha/admin/oai_sets.pl 2. Click on New set 3. Add a text in the field setSpec, setName that contains js 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66080 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl To Test 1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl 2. Add a text in the field Name and Label that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Fixed for new and edit page Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66081 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in classsources.pl Fixed for both Classification sources & Classification filing rules To Test 1. first case classification source: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_source second case classification filing rules: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66082 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in authtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66083 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in fieldmapping.pl To Test 1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl 2. Add a text in the field Field name that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66084 [details] [review] [SIGNED OFF] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl To Test 1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Click on Actions -> MARC structure 6. Apply patch and reload, the js is escaped Fixed for both the pages biblio_framework.pl and marctagstructure.pl Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 66085 [details] [review] Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt To test: - Add a framework with script in the description - Access the Keywords to MARC mapping page - Add an item search field where both name and label are script - Try to edit/delete the added mapping With the patch no script should be executed and everything should still work ok.
Created attachment 66442 [details] [review] Bug 19108 - Stored XSS in oai_sets.pl To Test 1. Hit the page /cgi-bin/koha/admin/oai_sets.pl 2. Click on New set 3. Add a text in the field setSpec, setName that contains js 4. Save the page. 5. Notice js is execute 6. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66443 [details] [review] Bug 19108 - Stored XSS in items_search_fields.pl To Test 1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl 2. Add a text in the field Name and Label that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Fixed for new and edit page Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66444 [details] [review] Bug 19108 - Stored XSS in classsources.pl Fixed for both Classification sources & Classification filing rules To Test 1. first case classification source: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_source second case classification filing rules: Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66445 [details] [review] Bug 19108 - Stored XSS in authtypes.pl To Test 1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66446 [details] [review] Bug 19108 - Stored XSS in fieldmapping.pl To Test 1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl 2. Add a text in the field Field name that contains js 3. Save the page. 4. Notice js is execute 5. Apply patch and reload, the js is escaped Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66447 [details] [review] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl To Test 1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form 2. Add a text in the field Description that contains js 3. Save the page. 4. Notice js is execute 5. Click on Actions -> MARC structure 6. Apply patch and reload, the js is escaped Fixed for both the pages biblio_framework.pl and marctagstructure.pl Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 66448 [details] [review] Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt To test: - Add a framework with script in the description - Access the Keywords to MARC mapping page - Add an item search field where both name and label are script - Try to edit/delete the added mapping With the patch no script should be executed and everything should still work ok. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
We are just fixing admin scripts, not very useful.
Created attachment 67085 [details] [review] Bug 19108: (follow-up) Stored XSS in biblio_framework.pl Prevent software error Template process failed: undef error - text: filter not found at /home/vagrant/kohaclone/C4/Templates.pm line 121.
This patch has been pushed to 16.11.x and will be in 16.11.12.
These patches have been pushed to 17.05.x and are in 17.05.04.
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 16.05.x, for 16.05.17 release