Bug 19034

Summary: XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Tomás Cohen Arazi <tomascohen>
Severity: major    
Priority: P5 - low CC: chris, fridolin.somers, gmcharlt, indradg, jonathan.druart, katrin.fischer, ldjamison, m.de.rooy, mtj, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19034 - XSS Flaws in Patron categories pages
Bug 19034 - XSS Flaws in Cities
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration
Bug 19034: XSS Flaws in Patron categories pages
Bug 19034: XSS Flaws in Cities
Bug 19034: XSS Flaws in Z39.50/SRU servers administration
Bug 19034: (followup) Fix letters.tt XSS flaw
Bug 19034: (followup 2) Fix letters.tt XSS flaw

Description Amit Gupta 2017-08-04 04:27:03 UTC
XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Comment 1 Amit Gupta 2017-08-04 05:17:35 UTC
Created attachment 65485 [details] [review]
Bug 19034 - XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-04 05:18:40 UTC
Created attachment 65486 [details] [review]
Bug 19034 - XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.
Comment 3 Amit Gupta 2017-08-04 05:19:39 UTC
Created attachment 65487 [details] [review]
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.
Comment 4 Katrin Fischer 2017-08-04 05:23:43 UTC
Hi Amit, thx for reporting and fixing this! Please file security relevant bugs in the 'Koha security' Product, that is not generally visible until the bug is properly fixed.
Comment 5 Amit Gupta 2017-08-04 05:26:35 UTC
Hi Katrin,

Thanks!!
Comment 6 Tomás Cohen Arazi 2017-08-07 14:22:32 UTC
Created attachment 65559 [details] [review]
Bug 19034: XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 7 Tomás Cohen Arazi 2017-08-07 14:22:39 UTC
Created attachment 65560 [details] [review]
Bug 19034: XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Tomás Cohen Arazi 2017-08-07 14:22:48 UTC
Created attachment 65561 [details] [review]
Bug 19034: XSS Flaws in Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 9 Tomás Cohen Arazi 2017-08-07 14:27:55 UTC
Created attachment 65562 [details] [review]
Bug 19034: (followup) Fix letters.tt XSS flaw

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 10 Amit Gupta 2017-08-07 14:29:33 UTC
Thanks Tomas i am working on some other XSS issues also.
Comment 11 Tomás Cohen Arazi 2017-08-07 14:50:34 UTC
(In reply to Amit Gupta from comment #10)
> Thanks Tomas i am working on some other XSS issues also.

I've patched letter.tt here. bGreat job finding them!
Comment 12 Jonathan Druart 2017-08-15 16:26:36 UTC
Created attachment 66028 [details] [review]
Bug 19034: (followup 2) Fix letters.tt XSS flaw
Comment 13 Jonathan Druart 2017-08-29 15:07:17 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 14 Fridolin Somers 2017-09-05 12:44:52 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 15 Katrin Fischer 2017-09-07 06:15:12 UTC
This patches have been pushed to 16.11.x and are in 16.11.11.
Comment 16 Mason James 2017-09-20 02:37:57 UTC
Pushed to 16.05.x, for 16.05.16 release - thanks Amit :0)