Created attachment 155527 [details] XSS PoC Hello, how are you? I come back and make the report for the XSS vulnerability reflected in koha marc21 and koha unimarc There is a vulnerability in the advanced search component once authenticated, the vulnerability is exploited in the same way in both software, the vulnerability is for the latest version "23.05.03" the ones to reproduce it are these - First we log in to the platform, using the credentials that we configured during the installation. - then we go to an advanced configuration, the endpoint is this "http://localhost:8001/cgi-bin/koha/catalogue/search.pl" - See there in each of the checkpoints of the advanced search we place our payload - our payload is "><script>alert(1);</script> and with this we get the xss reflected Below I attach a screenshot of how the PoC is done
The vulnerability has already been reported to Miter for due process with the issue of CVE assignment, please let me know if you need any other information.
Created attachment 155528 [details] Poc2 xss
To remedy we can do Ensure that all user inputs, including form fields, URL parameters, and cookies, are properly validated on both the client and server sides. Reject or sanitize any input that contains potentially harmful code.
Reported to Mitre*
Thank you, Angel for providing written details and some images. That's very helpful. I'll take a look at this tomorrow if no one else looks at it before then.
Thanks to you, I am working on finding more vulnerabilities in the platform as well and reporting it to you so that you can improve security. Let me know about this XSS reflected and the assigned CVE.
Created attachment 155581 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]}
Thank you very much for taking my report seriously, and starting to work on solving it.
Created attachment 155598 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]} Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Created attachment 155637 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]} Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Hello, the CVE has already been released, I hope the CNA has contacted you The CVE number is CVE-2023-5025
Pushed to master for 23.11. Nice work everyone, thanks!
(In reply to Angel Metz from comment #12) > Hello, the CVE has already been released, I hope the CNA has contacted you > > The CVE number is CVE-2023-5025 Hi Angel, someone has re-reported this in Koha. Can you send an update to the CNA where you lodged the CVE? It looks like this was fixed shortly after you reported it. From version 23.05.04 onward.