Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )
Summary: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities...
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Templates (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Kyle M Hall (khall)
QA Contact: Testopia
URL:
Keywords:
Depends on: 22478
Blocks: 37595
  Show dependency treegraph
 
Reported: 2022-06-15 16:06 UTC by Kyle M Hall (khall)
Modified: 2024-08-07 14:59 UTC (History)
14 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
22.05.03, 21.11.10, 21.05.17
Circulation function:


Attachments
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) (1.59 KB, patch)
2022-06-15 16:08 UTC, Kyle M Hall (khall)
Details | Diff | Splinter Review
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) (1.66 KB, patch)
2022-06-17 14:15 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) (1.66 KB, patch)
2022-06-17 14:19 UTC, Martin Renvoize (ashimema)
Details | Diff | Splinter Review
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) (1.71 KB, patch)
2022-06-27 22:22 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle M Hall (khall) 2022-06-15 16:06:02 UTC
There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1
Comment 1 Kyle M Hall (khall) 2022-06-15 16:08:17 UTC
Created attachment 136096 [details] [review]
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!
Comment 2 Martin Renvoize (ashimema) 2022-06-17 14:15:36 UTC
Created attachment 136289 [details] [review]
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 3 Martin Renvoize (ashimema) 2022-06-17 14:16:03 UTC
Fixes the bug as described.. signing off
Comment 4 Martin Renvoize (ashimema) 2022-06-17 14:19:18 UTC
Created attachment 136290 [details] [review]
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 5 Liz Rea 2022-06-17 16:30:47 UTC
Howdi, 

May we have a QA on this please :)

Thanking you,

Liz
Comment 6 Chris Cormack 2022-06-27 22:22:03 UTC
Created attachment 136662 [details] [review]
Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )

There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar.

https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1

Test Plan:
1) Use the URL above to show the XSS vulnerability exists
2) Apply this patch
3) Restart all the things!
4) Reload the page, no XSS vulnerability!

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Comment 7 Tomás Cohen Arazi (tcohen) 2022-06-30 14:24:49 UTC
(In reply to Chris Cormack from comment #6)
> Created attachment 136662 [details] [review] [review]
> Bug 30969: Cross site scripting (XSS) attack in OPAC authority search (
> opac-authorities-home.pl )
> 
> There appears to be a cross site scripting attack vulnerability in
> opac-authorities-home.pl, but may be accessible from any page using
> C4::Output::pagination_bar.
> 
> https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.
> pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/
> ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&opera
> tor=contains&orderby=HeadingAsc&type=opac&value=1
> 
> Test Plan:
> 1) Use the URL above to show the XSS vulnerability exists
> 2) Apply this patch
> 3) Restart all the things!
> 4) Reload the page, no XSS vulnerability!
> 
> Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

This one missed the 22.05.01 merge. Sorry for that.
Comment 8 Victor Grousset/tuxayo 2022-07-22 20:49:40 UTC
Backported: Pushed to 21.05.x-security branch for 21.05.17
Comment 9 Arthur Suzuki 2022-07-25 08:29:01 UTC
pushed to 21.11.x for 21.11.10, thx!
Comment 10 Lucas Gass (lukeg) 2022-07-25 14:23:34 UTC
Backported to 22.05.x for 22.05.03