Bug 11341

Summary: XSS attack vector in facets in OPAC - prog theme
Product: Koha Reporter: Chris Cormack <chris>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: fridolin.somers, gmcharlt, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13618
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 11341 : XSS in opac-search.pl (facets)
Bug 11341 : XSS in opac-search.pl (facets)
[PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets)

Description Chris Cormack 2013-12-04 21:12:58 UTC
If you craft some html in the offset variable, you can create an xss attack in the show more link in the facets.

Patch to follow
Comment 1 Chris Cormack 2013-12-04 21:24:26 UTC Comment hidden (obsolete)
Comment 2 Tomás Cohen Arazi 2013-12-04 21:30:33 UTC Comment hidden (obsolete)
Comment 3 Brendan Gallagher 2013-12-04 21:57:12 UTC
Created attachment 23313 [details] [review]
[PASSED-QA] Bug 11341 : XSS in opac-search.pl (facets)

prog theme, bootstrap theme is safe

To test
1/ Craft a url like
 cgi-bin/koha/opac-search.pl?idx=kw&q=fish&offset=20" onmouseover%3dprompt(994000) bad%3d"
 (the search must return enough results to have a show more link in the facets)

2/ Check the source, or mouseover the Show more links in the facets
   Notice the code is executable

3/ Apply patch - notice it is no longer executable

Signed-off-by: Tomas Cohen Arazi <tomascohen@gmail.com>
Signed-off-by: Brendan Gallagher <brendan@bywatersolutions.com>
Comment 4 Galen Charlton 2013-12-04 22:02:12 UTC
Pushed to master.  Thanks, Chris!
Comment 5 Fridolin Somers 2013-12-13 15:35:11 UTC
This patch has been pushed to 3.14.x, will be in 3.14.1
Comment 6 Tomás Cohen Arazi 2013-12-23 15:30:44 UTC
This patch has been pushed to 3.12.x, will be in 3.12.8.

Thanks Chris!