Bug 34761 - Stored/reflected XSS with searches and saved search filters
Summary: Stored/reflected XSS with searches and saved search filters
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Searching (show other bugs)
Version: unspecified
Hardware: All All
: P1 - high major
Assignee: David Cook
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 17170
Blocks:
  Show dependency treegraph
 
Reported: 2023-09-12 05:10 UTC by Angel Metz
Modified: 2025-06-02 20:46 UTC (History)
11 users (show)

See Also:
GIT URL:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10
Circulation function:


Attachments
XSS PoC (64.60 KB, image/png)
2023-09-12 05:10 UTC, Angel Metz
Details
Poc2 xss (60.87 KB, image/png)
2023-09-12 05:14 UTC, Angel Metz
Details
Bug 34761: Prevent XSS for searches and saved search filters (3.72 KB, patch)
2023-09-13 01:45 UTC, David Cook
Details | Diff | Splinter Review
Bug 34761: Prevent XSS for searches and saved search filters (3.77 KB, patch)
2023-09-13 21:15 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review
Bug 34761: Prevent XSS for searches and saved search filters (3.87 KB, patch)
2023-09-15 06:43 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Angel Metz 2023-09-12 05:10:44 UTC
Created attachment 155527 [details]
XSS PoC

Hello, how are you? I come back and make the report for the XSS vulnerability reflected in koha marc21 and koha unimarc

There is a vulnerability in the advanced search component once authenticated, the vulnerability is exploited in the same way in both software, the vulnerability is for the latest version "23.05.03" the ones to reproduce it are these

- First we log in to the platform, using the credentials that we configured during the installation.

- then we go to an advanced configuration, the endpoint is this "http://localhost:8001/cgi-bin/koha/catalogue/search.pl"

- See there in each of the checkpoints of the advanced search we place our payload

- our payload is "><script>alert(1);</script> and with this we get the xss reflected

Below I attach a screenshot of how the PoC is done
Comment 1 Angel Metz 2023-09-12 05:12:17 UTC
The vulnerability has already been reported to Miter for due process with the issue of CVE assignment, please let me know if you need any other information.
Comment 2 Angel Metz 2023-09-12 05:14:21 UTC
Created attachment 155528 [details]
Poc2 xss
Comment 3 Angel Metz 2023-09-12 05:24:22 UTC
To remedy we can do Ensure that all user inputs, including form fields, URL parameters, and cookies, are properly validated on both the client and server sides. Reject or sanitize any input that contains potentially harmful code.
Comment 4 Angel Metz 2023-09-12 06:50:37 UTC
Reported to Mitre*
Comment 5 David Cook 2023-09-12 06:55:12 UTC
Thank you, Angel for providing written details and some images. That's very helpful.

I'll take a look at this tomorrow if no one else looks at it before then.
Comment 6 Angel Metz 2023-09-12 07:00:29 UTC
Thanks to you, I am working on finding more vulnerabilities in the platform as well and reporting it to you so that you can improve security. Let me know about this XSS reflected and the assigned CVE.
Comment 7 David Cook 2023-09-13 01:45:12 UTC
Created attachment 155581 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}
Comment 9 Angel Metz 2023-09-13 07:46:25 UTC
Thank you very much for taking my report seriously, and starting to work on solving it.
Comment 10 Lucas Gass (lukeg) 2023-09-13 21:15:22 UTC
Created attachment 155598 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 11 Marcel de Rooy 2023-09-15 06:43:13 UTC
Created attachment 155637 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 12 Angel Metz 2023-09-17 15:40:45 UTC
Hello, the CVE has already been released, I hope the CNA has contacted you

The CVE number is CVE-2023-5025
Comment 13 Tomás Cohen Arazi (tcohen) 2023-09-25 22:09:26 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 14 David Cook 2024-02-14 03:13:09 UTC
(In reply to Angel Metz from comment #12)
> Hello, the CVE has already been released, I hope the CNA has contacted you
> 
> The CVE number is CVE-2023-5025

Hi Angel, someone has re-reported this in Koha. Can you send an update to the CNA where you lodged the CVE? It looks like this was fixed shortly after you reported it. From version 23.05.04 onward.