Description
Raschin Tavakoli
2015-06-18 18:18:40 UTC
Created attachment 40333 [details]
Screenshots with Exploit Scenario
The screenshots show the input in the OPAC interface (victim1 - alice), the target victim in the Staff client (bob), and the permissions page of alice and bob.
As we can see, alice, has very restricted permissions various bob has superlibrarian permissions set.
*** Bug 14415 has been marked as a duplicate of this bug. *** Created attachment 40340 [details] [review] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit Created attachment 40341 [details] [review] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Created attachment 40353 [details] [review] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40354 [details] [review] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40355 [details] [review] Bug 14416: (follow-up) opac addbybilionumber Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40356 [details] [review] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Found 2 more at the OPAC and I submitted a patch for the intranet side (which was affected too). if ( $var =~ m|<script>| ) { $template->param( error => "CONVOKE_STUDENT" ); } :) Created attachment 40370 [details] [review] [PASSED QA] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Created attachment 40371 [details] [review] [PASSED QA] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Created attachment 40372 [details] [review] [PASSED QA] Bug 14416: (follow-up) opac addbybilionumber Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Created attachment 40373 [details] [review] [PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Patches pushed to master. Good job Chris! Pushed to 3.20.x will be in 3.20.1 Pushed to 3.14.x, will be in 3.14.16 Pushed to 3.16.x, will be in 3.16.12 |