From 29035a372fdc0148f33f07ec89530094217f87d6 Mon Sep 17 00:00:00 2001 From: Jonathan Druart Date: Fri, 19 Jun 2015 10:12:45 +0200 Subject: [PATCH] Bug 14408 Path traversal vulnerability /cgi-bin/koha/svc/virtualshelves/search /cgi-bin/koha/svc/members/search Are vulnerable To test: 1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt Notice you get a valid JSON response 2/ Hit /search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd (You may have add more ..%2f or remove them to get the correct path) Notice you can see the contents of the /etc/passwd file 3/ Hit /cgi-bin/koha/svc/members/search?template_path=test%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd 4/ Apply patch 5/ Hit the first url again, notice it still works 6/ Hit the second url notice it now errors with a file not found 7/ Hit the third url notice it now errors with a file not found Repeat for the other script also --- C4/Auth.pm | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/C4/Auth.pm b/C4/Auth.pm index 0d21575..a048c97 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -158,6 +158,10 @@ sub get_template_and_user { C4::Context->interface( $in->{type} ); + # Sanitize template path to avoid path traversal + $in->{template_name} =~ s|^/||; + $in->{template_name} =~ s|\.\.||g; + $in->{'authnotrequired'} ||= 0; my $template = C4::Templates::gettemplate( $in->{'template_name'}, -- 2.1.0