From 2eaf4cc857cf582b7592c5426d65554926494d17 Mon Sep 17 00:00:00 2001 From: Chris Cormack Date: Fri, 19 Jun 2015 09:07:44 +1200 Subject: [PATCH] Bug 14408 Path traversal vulnerability /cgi-bin/koha/svc/virtualshelves/search /cgi-bin/koha/svc/members/search Are vulnerable To test: 1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt Notice you get a valid JSON response 2/ Hit /search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file 3/ Apply patch 4/ Hit the first url again, notice it still works 5/ Hit the second url notice it now errors with a file not found Repeat for the other script also --- svc/members/search | 4 +++- svc/virtualshelves/search | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/svc/members/search b/svc/members/search index 6343e2e..caf4682 100755 --- a/svc/members/search +++ b/svc/members/search @@ -29,9 +29,11 @@ use Koha::DateUtils qw( output_pref dt_from_string ); my $input = new CGI; exit unless $input->param('template_path'); +my $template_path= $input->param('template_path'); + $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie my ($template, $user, $cookie) = get_template_and_user({ - template_name => $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, diff --git a/svc/virtualshelves/search b/svc/virtualshelves/search index ef1448c..b33b03e 100755 --- a/svc/virtualshelves/search +++ b/svc/virtualshelves/search @@ -12,8 +12,10 @@ my $input = new CGI; exit unless $input->param('template_path'); +my $template_path= $input->param('template_path'); + $template_path =~ s/[^a-zA-Z_-]*//; #sanitzie my ($template, $user, $cookie) = get_template_and_user({ - template_name => $input->param('template_path'), + template_name => $template_path, query => $input, type => "intranet", authnotrequired => 0, -- 2.1.4