Bug 14360

Summary: XSS Injection point
Product: Koha Reporter: Vincent <vincent.junik>
Component: OPACAssignee: Aleisha Amohia <aleisha>
Status: CLOSED FIXED QA Contact: Chris Cormack <chris>
Severity: major    
Priority: P5 - low CC: fridolin.somers, gmc, jonathan.druart, katrin.fischer, kyle, liz, m.de.rooy, mtj, tomascohen, vincent.junik
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Attachments: Bug 14360: Unescaped variable causes alert
Bug 14360: Unescaped variable causes alert pop-up
[SIGNED OFF] Bug 14360: Unescaped variable causes alert
[SIGNED OFF] Bug 14360: Unescaped variable causes alert pop-up
[PASSED QA] Bug 14360: Unescaped variable causes alert
[PASSED QA] Bug 14360: Unescaped variable causes alert pop-up

Description Vincent 2015-06-07 14:51:00 UTC
Got injection point in some query like :

opac-authorities-home.pl?op=do_search&resultsperpage=1"><script>alert(document.cookie)</script>

But another funny is to create a list with a js code in the name and it will be readen on delet like :

<script>alert(document.cookie);</script>

I didn't try all the $ for injection point but i think you should bullet proof it with an sqlmap on all of them. And to test some scan with kali's tool or ask for someone who can use them to bullet proof it. 

Regards.

Vincent.
Comment 1 Katrin Fischer 2015-06-07 19:59:55 UTC
Vincent helped me out on IRC with a link that makes the first problem visible on Bywater's demo installation (3.19...):

http://catalog.bywatersolutions.com/cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Comment 2 Katrin Fischer 2015-06-07 20:17:26 UTC
For the second issue:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'

Tested on current master.
Comment 3 Aleisha Amohia 2015-06-08 04:57:02 UTC Comment hidden (obsolete)
Comment 4 Aleisha Amohia 2015-06-09 04:25:04 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2015-06-09 21:38:05 UTC Comment hidden (obsolete)
Comment 6 Katrin Fischer 2015-06-09 21:38:18 UTC Comment hidden (obsolete)
Comment 7 Katrin Fischer 2015-06-09 21:42:38 UTC
Can we get some QA on this next please? :)
Comment 8 Kyle M Hall 2015-06-10 13:16:14 UTC
Created attachment 40066 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Kyle M Hall 2015-06-10 13:16:21 UTC
Created attachment 40067 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Tomás Cohen Arazi 2015-06-11 13:18:01 UTC
Patches pushed to master.

Thanks Aleisha!
Comment 11 Chris Cormack 2015-06-11 20:11:47 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 12 Chris Cormack 2015-06-17 22:32:50 UTC
Mason and liz you might want to take a look at this one
Comment 13 Liz Rea 2015-06-19 04:07:42 UTC
I have this in my branch for 3.18. I still can't seem to get my keys to work for git.koha-community.org.
Comment 14 Liz Rea 2015-06-23 01:57:20 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 15 Fridolin Somers 2015-06-23 09:42:56 UTC
Pushed to 3.14.x, will be in 3.14.16