Bug 23058 - Cross-site scripting in OPAC search
Summary: Cross-site scripting in OPAC search
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-05 19:44 UTC by systems_analysts
Modified: 2020-11-30 21:45 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00, 19.05.01, 18.11.07, 18.05.14
Circulation function:

Attachments
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (899 bytes, patch)
2019-06-05 23:43 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (955 bytes, patch)
2019-06-06 12:16 UTC, Nick Clemens (kidclamp) 		Details | Diff | Splinter Review
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (1013 bytes, patch)
2019-06-09 20:30 UTC, Katrin Fischer 		Details | Diff | Splinter Review
Show Obsolete (2) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Jonathan Druart 2019-06-05 23:42:15 UTC 
Confirmed, good catch.

Hiding the URL from the description:

GET: https://catalog.kohadev.local/cgi-bin/koha/opac-search.pl?tag=ft%22%3E<script>alert(150)</script>&q=ft

ATTACK DETAILS:
This page is vulnerable to Cross-site scripting attacks.

Cross-site scripting attacks, in general, are an issue because
they are enabling attacks. Specially-crafted malicious URLs can
steal authentication tokens/cookies when a logged-in user visits them,
giving the attacker full access to that user's account in the application.
Reflected XSS attacks, in particular, are a concern as they can be used to
socially engineer a user into clicking on what appears to be a legitimate URL.
Comment 2 Jonathan Druart 2019-06-05 23:43:54 UTC 
Created attachment 90342 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Comment 3 Nick Clemens (kidclamp) 2019-06-06 12:16:43 UTC 
Created attachment 90358 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Katrin Fischer 2019-06-09 20:30:07 UTC 
Created attachment 90447 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Martin Renvoize (ashimema) 2019-07-02 07:56:47 UTC 
Nice work!

Pushed to master for 19.11.00
Comment 6 Martin Renvoize (ashimema) 2019-07-02 08:10:21 UTC 
Also pushed, and released, to stable, oldstable and oldoldstable
Comment 7 Liz Rea 2019-07-02 16:23:46 UTC 
pushed to 18.05 for 18.05.14