Hello community, We've recently had a penetration test run on one of our servers and it returned a vulnerability within the ysearch.pl file. As you can see from the following this was discovered within 23.05.04 but is also present within 22.11.10: https://nvd.nist.gov/vuln/detail/CVE-2023-44961 The following GitHub explains the PoC for this vulnerability: https://github.com/ggb0n/CVE-2023-44961
Can easily be fixed as it's only used in a couple of places: cataloguing/value_builder/marc21_field_260b.pl: source: '/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode', koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_210c_bis.tt: source: "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode", koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/unimarc_field_225a_bis.tt: source: "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=collectiontitle", Sanitizing the input should be trivial.
(In reply to Jonathan Druart from comment #1) > Can easily be fixed as it's only used in a couple of places: > > cataloguing/value_builder/marc21_field_260b.pl: source: > '/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode', > koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/ > unimarc_field_210c_bis.tt: source: > "/cgi-bin/koha/cataloguing/ysearch.pl?table=biblioitems&field=publishercode", > koha-tmpl/intranet-tmpl/prog/en/modules/cataloguing/value_builder/ > unimarc_field_225a_bis.tt: source: > "/cgi-bin/koha/cataloguing/ysearch. > pl?table=biblioitems&field=collectiontitle", > > Sanitizing the input should be trivial. Looks like we're already filtering "table", so "field" just needs to be filtered as well for "publishercode" or "collectiontitle" it seems?
Created attachment 158682 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear
Created attachment 158762 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear Signed-off-by: Owen Leonard <oleonard@myacpl.org>
Created attachment 158763 [details] [review] Bug 35290: (follow-up) Perltidy formatting corrections
Created attachment 158764 [details] [review] Bug 35290: Sanitize field input on cataloguing/ysearch.pl This change sanitizies the field input on cataloguing/ysearch.pl Test plan: 0. Apply the patch and restart/reload Koha 1a. "Add marc21_field_260b.pl plugin to 260$b in the Default framework" 1b. Go to http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl? op=add_form&tagfield=260&frameworkcode=#subbfield 1c. Choose "marc21_field_260b.pl" from the dropdown next to "Plugin" 1d. Click "Save changes" 2a. "Add new record" 2b. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?frameworkcode= 3. Click on tab "2" and scroll down to 260 "b" 4. Type in "Ori" into 260 subfield b 5. Some autocomplete suggestions should appear Signed-off-by: Owen Leonard <oleonard@myacpl.org> Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Created attachment 158765 [details] [review] Bug 35290: (follow-up) Perltidy formatting corrections Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Pushed to master for 23.11. Nice work everyone, thanks!
--- a/cataloguing/ysearch.pl +++ b/cataloguing/ysearch.pl @@ -1,4 +1,4 @@ -#!/usr/bin/perl + #!/usr/bin/perl Whooo is this normal ?
(In reply to Fridolin Somers from comment #9) > --- a/cataloguing/ysearch.pl > +++ b/cataloguing/ysearch.pl > @@ -1,4 +1,4 @@ > -#!/usr/bin/perl > + #!/usr/bin/perl > > Whooo is this normal ? Looks like a bad perltidy to me. It probably won't have any negative consequences overall when using Plack instead of CGI. But good to fix that I'd say.
Pushed to 21.11.x for 21.11.26
(In reply to Fridolin Somers from comment #9) > --- a/cataloguing/ysearch.pl > +++ b/cataloguing/ysearch.pl > @@ -1,4 +1,4 @@ > -#!/usr/bin/perl > + #!/usr/bin/perl > > Whooo is this normal ? We should catch that in qa tools ?
(In reply to David Cook from comment #10) > It probably won't have any negative consequences overall when using Plack > instead of CGI. But good to fix that I'd say. Done on 35835
Do we move this back to Koha project now?
(In reply to David Cook from comment #14) > Do we move this back to Koha project now? Yes, done.