| Summary: | XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Amit Gupta <amitddng135> |
| Component: | Architecture, internals, and plumbing | Assignee: | Amit Gupta <amitddng135> |
| Status: | CLOSED FIXED | QA Contact: | Tomás Cohen Arazi (tcohen) <tomascohen> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | chris, fridolin.somers, gmcharlt, indradg, jonathan.druart, ldjamison, m.de.rooy, mtj, tomascohen |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 14568 | ||
| Attachments: |
Bug 19034 - XSS Flaws in Patron categories pages
Bug 19034 - XSS Flaws in Cities Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration Bug 19034: XSS Flaws in Patron categories pages Bug 19034: XSS Flaws in Cities Bug 19034: XSS Flaws in Z39.50/SRU servers administration Bug 19034: (followup) Fix letters.tt XSS flaw Bug 19034: (followup 2) Fix letters.tt XSS flaw |
||
|
Description
Amit Gupta
2017-08-04 04:27:03 UTC
Created attachment 65485 [details] [review] Bug 19034 - XSS Flaws in Patron categories pages 1. Hit /cgi-bin/koha/admin/categories.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search patron categories box. 6. Notice it is no longer executed. Created attachment 65486 [details] [review] Bug 19034 - XSS Flaws in Cities 1. Hit /cgi-bin/koha/admin/cities.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search cities box. 6. Notice it is no longer executed. Created attachment 65487 [details] [review] Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration 1. Hit /cgi-bin/koha/admin/z3950servers.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search Z39.50/SRU servers box. 6. Notice it is no longer executed. Hi Amit, thx for reporting and fixing this! Please file security relevant bugs in the 'Koha security' Product, that is not generally visible until the bug is properly fixed. Hi Katrin, Thanks!! Created attachment 65559 [details] [review] Bug 19034: XSS Flaws in Patron categories pages 1. Hit /cgi-bin/koha/admin/categories.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search patron categories box. 6. Notice it is no longer executed. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 65560 [details] [review] Bug 19034: XSS Flaws in Cities 1. Hit /cgi-bin/koha/admin/cities.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search cities box. 6. Notice it is no longer executed. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 65561 [details] [review] Bug 19034: XSS Flaws in Z39.50/SRU servers administration 1. Hit /cgi-bin/koha/admin/z3950servers.pl 2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box. 3. Notice the iframe is executed. 4. Apply patch. 5. Reload page, and enter iframe again on search Z39.50/SRU servers box. 6. Notice it is no longer executed. Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Created attachment 65562 [details] [review] Bug 19034: (followup) Fix letters.tt XSS flaw Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> Thanks Tomas i am working on some other XSS issues also. (In reply to Amit Gupta from comment #10) > Thanks Tomas i am working on some other XSS issues also. I've patched letter.tt here. bGreat job finding them! Created attachment 66028 [details] [review] Bug 19034: (followup 2) Fix letters.tt XSS flaw Pushed to master for 17.11, thanks to everybody involved! Pushed to 17.05.x, is in 17.05.03 This patches have been pushed to 16.11.x and are in 16.11.11. Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0) |