Created attachment 66027 [details] html file for PoC The following issues were identified, Koha was installed on ubuntu 16.04 and mySQL with default configuration: Vulnerability Type: Cross-site request forgery Affected Product: koha library system Tested Version: 17.05.02 Discovered by: Jiaky Ooi Affected URL: 1) /cgi-bin/koha/members/paycollect.pl Affected Parameter: borrowernumber, amount, amountoutstanding, paid Please be aware that we will publish these vulnerability on the disclosure date when agreed. Please reserve CVE number for this vulnerability by contacting Mitre. Further information can be found at https://cve.mitre.org/cve/request_id.html Please see attached for html payload used for PoC. Many thanks _________________________________________________________ Jiaky Ooi | Consultant Oxford +44 (0)1865 877 830 Dubai +971 (0)4 427 0428 London +44 (0)203 5983740 New York +1 646-781-7580 E-Mail jiaky.ooi@dionach.com Web www.dionach.com
Yes, all the forms are vulnerable for CSRF attacks, only the following scripts are fixed: authorities/authorities-home.pl authorities/detail.pl basket/sendbasket.pl members/deletemem.pl members/member-flags.pl members/member-password.pl members/memberentry.pl members/moremember.pl opac/opac-memberentry.pl opac/opac-sendbasket.pl opac/sco/sco-main.pl opac/sco/sco-patron-image.pl tools/import_borrowers.pl tools/picture-upload.pl
Thanks for the prompt reply, just a verification please. Would this mean that this will not be a 0day bug and we would require to implement custom CSRF countermeasures?
It is a known bug (at least by me). With my answer I wanted to tell that the vulnerability is not specific to members/paycollect.pl, several other scripts are impacted. We first fixed the forms that had a big impacts on the patron data and security (change of password, patron's detail, permissions, deletion of a patron's entry, etc.) as well as all forms of the public interface (OPAC). It is on my todo list, but I am not considering it as high priority for now. > Would this mean that this will not be a 0day bug and we would require to > implement custom CSRF countermeasures? If you implement such fixes, please share them with us :)
(In reply to Jonathan Druart from comment #3) > It is a known bug (at least by me). > > With my answer I wanted to tell that the vulnerability is not specific to > members/paycollect.pl, several other scripts are impacted. > > We first fixed the forms that had a big impacts on the patron data and > security (change of password, patron's detail, permissions, deletion of a > patron's entry, etc.) as well as all forms of the public interface (OPAC). > > It is on my todo list, but I am not considering it as high priority for now. > > > Would this mean that this will not be a 0day bug and we would require to > > implement custom CSRF countermeasures? > > If you implement such fixes, please share them with us :) Apologies if I caused any misunderstanding. We are not a KOHA library user. We are a pen testing company that found this vulnerability while performing a pen test for a client. The previous question was intended to ask if the client should implement their own workaround or should they wait on a stable release from KOHA. As this is a known issue as mentioned on your previous comment, was I the first to report this issue to KOHA? And are there any CVE numbers reserved or assigned to this issue?
(In reply to Jiaky Ooi from comment #4) > The previous question was intended to ask if the client should implement > their own workaround or should they wait on a stable release from KOHA. What would be a workaround? As I told you earlier it is on my list, but I do not know when I will have time to dedicate to this issue. > As this is a known issue as mentioned on your previous comment, was I the > first to report this issue to KOHA? And are there any CVE numbers reserved > or assigned to this issue? There are no CVE reserved. paycollect.pl is only one of the several scripts that are vulnerable for CSRF attacks.
Created attachment 67616 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab.
Created attachment 67800 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 68043 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to master for 17.11, thanks to everybody involved!
This patch has been pushed to 16.11.x and will be in 16.11.13.
These patches have been pushed to 17.05.x and are in 17.05.05.
Pushed to 16.05.x, for 16.05.18 release