Bug 19086

Summary: Multiple cross-site scripting vulnerabilities
Product: Koha Reporter: Jiaky Ooi <jiakyooi95>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, amitddng135, fridolin.somers, jonathan.druart, katrin.fischer, kyle, m.de.rooy, mtj, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19086 XSS in members/member.pl
Bug 19086 Stored XSS in circulation.pl
Bug 19086 XSS in members/member.pl
Bug 19086 Stored XSS in circulation.pl
Bug 19086 Stored XSS in routing-lists.pl
Bug 19086 Stored XSS in readingrec.pl
Bug 19086 Stored XSS in notices.pl
Bug 19086 Stored XSS in maninvoice.pl
Bug 19086 Stored XSS in boraccount.pl
Bug 19086 Stored XSS in mancredit.pl
Bug 19086 Stored XSS in circulation.pl
Bug 19086 Stored XSS in /cgi-bin/koha/acqui/supplier.pl?op=enter
Bug 19086 Stored XSS in subscription-add.pl
Bug 19086 Stored XSS in supplier.pl
Bug 19086 Stored XSS in subscription-add.pl
[SIGNED OFF] Bug 19086 XSS in members/member.pl
[SIGNED OFF] Bug 19086 Stored XSS in circulation.pl
[SIGNED OFF] Bug 19086 Stored XSS in supplier.pl
[SIGNED OFF] Bug 19086 Stored XSS in subscription-add.pl
Bug 19086 - Follow-up - XSS in supplier.tt
Bug 19086 - Follow-up - subscription-detail.pl
Bug 19086 XSS in members/member.pl
Bug 19086 Stored XSS in circulation.pl
Bug 19086 Stored XSS in supplier.pl
Bug 19086 Stored XSS in subscription-add.pl
Bug 19086 - Follow-up - XSS in supplier.tt
Bug 19086 - Follow-up - subscription-detail.pl

Description Jiaky Ooi 2017-08-11 10:57:53 UTC
The following issues were identified, Koha was installed on ubuntu 16.04 and mySQL with default configuration:

Vulnerability Type: Reflected Cross Site Scripting
Affected Product: koha library system
Tested Version: 17.05.02
Discovered by: Jiaky Ooi
Affected URL: /cgi-bin/koha/members/member.pl
Affected Parameter: searchmember


Proof of Concept:
Full link for PoC : /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>


Vulnerability Type: Stored Cross Site Scripting
Affected Product: koha library system
Tested Version: 17.05.02
Discovered by: Jiaky Ooi
Affected URL: 1) /cgi-bin/koha/acqui/supplier.pl?op=enter
              2) /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
              3) /cgi-bin/koha/serials/subscription-add.pl
Affected Parameter: 1) company_postal, physical, company_fax, accountnumber, contactposition, contact_fax, contact_notes, notes
                    2) borrower_message
                    3) Internalnotes, notes


Please be aware that we will publish these vulnerability on the disclosure date when agreed.

Please reserve CVE number for this vulnerability by contacting Mitre. Further information can be found at https://cve.mitre.org/cve/request_id.html 

I will be happy to provide further information on this vulnerability, including the mechanisms by which it was identified, and any pertinent technical information if required.

Many thanks

_________________________________________________________

Jiaky Ooi | Consultant

Oxford        +44 (0)1865 877 830
Dubai          +971 (0)4 427 0428  
London       +44 (0)203 5983740
New York    +1 646-781-7580

E-Mail        jiaky.ooi@dionach.com 
Web          www.dionach.com

 ®
Comment 1 Chris Cormack 2017-08-11 19:42:29 UTC
Created attachment 65927 [details] [review]
Bug 19086 XSS in members/member.pl

To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped
Comment 2 Chris Cormack 2017-08-11 19:56:36 UTC
Created attachment 65929 [details] [review]
Bug 19086 Stored XSS in circulation.pl

1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped
Comment 3 Chris Cormack 2017-08-11 20:03:14 UTC
2 left to go, 
/cgi-bin/koha/acqui/supplier.pl?op=enter

and

/cgi-bin/koha/serials/subscription-add.pl

I have to go out now tho, so hopefully someone else will grab those
Comment 4 Amit Gupta 2017-08-14 16:09:44 UTC
Created attachment 65958 [details] [review]
Bug 19086 XSS in members/member.pl

Tested and work OK.
Comment 5 Amit Gupta 2017-08-14 16:11:46 UTC
Hi Chris,

I am able to execute the java script after applying the patch also. (circulation.pl)
Comment 6 Amit Gupta 2017-08-14 16:17:23 UTC
If we are using HTML::Entities wil able to escape the js.
Comment 7 Amit Gupta 2017-08-14 16:22:33 UTC
Created attachment 65960 [details] [review]
Bug 19086 Stored XSS in circulation.pl

Used HTML::Entities - Encode or decode strings with HTML entities.
********************************************************************
1. Hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber
2. Notice the java script is executed.
4. Apply patch.
5. Reload page, and hit the page again /cgi-bin/koha/circ/circulation.pl?borrowernumber=xx<script>alert('amit')</script>.
   xx - is a borrowernumber.
6. Notice it is no longer executed.
Comment 8 Amit Gupta 2017-08-14 16:30:23 UTC
Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089)

I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl

Can you please provide us some screen shots.
Comment 9 Amit Gupta 2017-08-14 16:54:00 UTC
Created attachment 65965 [details] [review]
Bug 19086 Stored XSS in routing-lists.pl

1. Hit /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
3. Reload page, and hit the page again /cgi-bin/koha/members/routing-lists.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
4. Notice it is no longer executed.
Comment 10 Amit Gupta 2017-08-14 16:59:25 UTC
Created attachment 65966 [details] [review]
Bug 19086 Stored XSS in readingrec.pl

1. Hit /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/readingrec.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 11 Amit Gupta 2017-08-14 17:02:45 UTC
Created attachment 65967 [details] [review]
Bug 19086 Stored XSS in notices.pl

1. Hit /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/notices.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 12 Amit Gupta 2017-08-14 17:08:57 UTC
Created attachment 65968 [details] [review]
Bug 19086 Stored XSS in maninvoice.pl

1. Hit /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/maninvoice.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 13 Amit Gupta 2017-08-14 17:13:18 UTC
Created attachment 65969 [details] [review]
Bug 19086 Stored XSS in boraccount.pl

1. Hit /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/boraccount.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 14 Amit Gupta 2017-08-14 17:16:20 UTC
Created attachment 65970 [details] [review]
Bug 19086 Stored XSS in mancredit.pl

1. Hit /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
2. Notice java script is execute.
3. Apply patch.
4. Reload page, and hit the page again /cgi-bin/koha/members/mancredit.pl?borrowernumber=xx<script>alert('XSS Payload')</script>
   xx is a borrowernumber
5. Notice it is no longer executed.
Comment 15 Chris Cormack 2017-08-14 18:25:19 UTC
Amit the stored ones involve adding js to the database, if you see the test plan it is to do with adding js to a note then hitting the field. Different to passing js as a parameter.
Comment 16 Amit Gupta 2017-08-14 19:24:09 UTC
Created attachment 65972 [details] [review]
Bug 19086 Stored XSS in circulation.pl

Test and work OK.

I am moving others patches in new bug
Comment 17 Amit Gupta 2017-08-14 19:35:50 UTC
Need to fix 2 more.
Comment 18 Jiaky Ooi 2017-08-14 20:43:15 UTC
(In reply to Amit Gupta from comment #8)
> Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089)
> 
> I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl
> 
> Can you please provide us some screen shots.

Hi Amit,

Apologies I am trying to reproduce this at the moment but my resources are at a different office.

Please allow me up to 24 hours to provide you with an update.

Best regards,
Jiaky
Comment 19 Amit Gupta 2017-08-14 21:10:07 UTC
Created attachment 65984 [details] [review]
Bug 19086 Stored XSS in /cgi-bin/koha/acqui/supplier.pl?op=enter

1. To test - add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
2. Save the page.
3. Notice js is execute
4. Apply patch and reload the js is escaped
Comment 20 Amit Gupta 2017-08-14 21:21:23 UTC
Created attachment 65985 [details] [review]
Bug 19086 Stored XSS in subscription-add.pl

1. To test - add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 21 Amit Gupta 2017-08-14 21:21:53 UTC
(In reply to jiakyooi95 from comment #18)
> (In reply to Amit Gupta from comment #8)
> > Fixed: /cgi-bin/koha/acqui/supplier.pl (Please see bug: Bug 19089)
> > 
> > I didn't find any vulnerability in: /cgi-bin/koha/serials/subscription-add.pl
> > 
> > Can you please provide us some screen shots.
> 
> Hi Amit,
> 
> Apologies I am trying to reproduce this at the moment but my resources are
> at a different office.
> 
> Please allow me up to 24 hours to provide you with an update.
> 
> Best regards,
> Jiaky

I have fixed the remaining 2.
Comment 22 Amit Gupta 2017-08-14 21:30:47 UTC
Created attachment 65986 [details] [review]
Bug 19086 Stored XSS in supplier.pl

Some changes in test case.
*****************************
1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped
Comment 23 Amit Gupta 2017-08-14 21:33:27 UTC
Created attachment 65987 [details] [review]
Bug 19086 Stored XSS in subscription-add.pl

To Test
1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
2. Add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped
Comment 24 Katrin Fischer 2017-08-16 11:04:47 UTC
For subscription-detail I am not sure - people might have added html to the note fields on purpose to highlight some things in the OPAC more. With the html filter, this won't be permitted.
Comment 25 Katrin Fischer 2017-08-16 11:08:23 UTC
Created attachment 66058 [details] [review]
[SIGNED OFF] Bug 19086 XSS in members/member.pl

To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 26 Katrin Fischer 2017-08-16 11:08:27 UTC
Created attachment 66059 [details] [review]
[SIGNED OFF] Bug 19086 Stored XSS in circulation.pl

1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 27 Katrin Fischer 2017-08-16 11:08:30 UTC
Created attachment 66060 [details] [review]
[SIGNED OFF] Bug 19086 Stored XSS in supplier.pl

1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 28 Katrin Fischer 2017-08-16 11:08:34 UTC
Created attachment 66061 [details] [review]
[SIGNED OFF] Bug 19086 Stored XSS in subscription-add.pl

To Test
1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
2. Add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 29 Katrin Fischer 2017-08-16 11:08:37 UTC
Created attachment 66062 [details] [review]
Bug 19086 - Follow-up - XSS in supplier.tt

In preparation:
Make sure you enter <script>alert("sth")</script>
in all fields of a new vendor that are not validated
and save.

1) Access vendor summary page.
2) Verify scripts are executed
3) Apply patch
4) Verify scripts are on longer executed

This works in combination with the other patches for XSS
on this bug.
Comment 30 Katrin Fischer 2017-08-16 11:08:40 UTC
Created attachment 66063 [details] [review]
Bug 19086 - Follow-up - subscription-detail.pl

Add script to the callnumber field on adding a subscription.

Verify script is executed without this patch, but not with it.
Comment 31 Marcel de Rooy 2017-08-25 06:12:33 UTC
koha-tmpl/intranet-tmpl/prog/en/modules/acqui/supplier.tt
[% name |html %]</a> &rsaquo; Update: [% name %]
Forgot the second one here?
Comment 32 Marcel de Rooy 2017-08-25 06:13:04 UTC
Created attachment 66433 [details] [review]
Bug 19086 XSS in members/member.pl

To test
1/ hit /cgi-bin/koha/members/member.pl?&searchmember=<script>alert('XSS Payload')</script>
2/ Notice js is executed
3/ Apply patch, reload
4/ js is now escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 33 Marcel de Rooy 2017-08-25 06:13:09 UTC
Created attachment 66434 [details] [review]
Bug 19086 Stored XSS in circulation.pl

1/ To test add a message to a borrower that contains js
2/ hit /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number]
  where number is the borrowernumber of the borrower you set the message
  for
3/ Notice js is execute
4/ Apply patch, reload, js is escaped

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 34 Marcel de Rooy 2017-08-25 06:13:13 UTC
Created attachment 66435 [details] [review]
Bug 19086 Stored XSS in supplier.pl

1. Hit the page /cgi-bin/koha/acqui/supplier.pl?op=enter
2. Add a text in the field company_postal, physical, company_fax,
   accountnumber, contactposition, contact_fax, contact_notes, notes that contains java script
3. Save the page.
4. Notice js is execute
5. Apply patch and reload the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 35 Marcel de Rooy 2017-08-25 06:13:18 UTC
Created attachment 66436 [details] [review]
Bug 19086 Stored XSS in subscription-add.pl

To Test
1. Hit the page /cgi-bin/koha/serials/subscription-add.pl
2. Add a text in the field Public note and Nonpublic note
   that contains js (Internalnotes, notes)
2. Save the page.
3. Notice js is execute
4. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 36 Marcel de Rooy 2017-08-25 06:13:23 UTC
Created attachment 66437 [details] [review]
Bug 19086 - Follow-up - XSS in supplier.tt

In preparation:
Make sure you enter <script>alert("sth")</script>
in all fields of a new vendor that are not validated
and save.

1) Access vendor summary page.
2) Verify scripts are executed
3) Apply patch
4) Verify scripts are on longer executed

This works in combination with the other patches for XSS
on this bug.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 37 Marcel de Rooy 2017-08-25 06:13:28 UTC
Created attachment 66438 [details] [review]
Bug 19086 - Follow-up - subscription-detail.pl

Add script to the callnumber field on adding a subscription.

Verify script is executed without this patch, but not with it.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 38 Jiaky Ooi 2017-09-04 15:21:45 UTC
Hello,

Just a quick question please.

As the last comment made on this thread was on the 25th August, and this has been marked as Passed QA, will there be a CVE number assigned to this vulnerability please?

Best regards,
Jiaky
Comment 39 Jonathan Druart 2017-09-04 15:40:47 UTC
(In reply to Jiaky Ooi from comment #38)
> As the last comment made on this thread was on the 25th August, and this has
> been marked as Passed QA, will there be a CVE number assigned to this
> vulnerability please?

Hello Jiaky,

No, no CVE number will be assigned.

The patch is going to be pushed to master and stable branches simultaneously around September 22th.
Comment 40 Katrin Fischer 2017-09-19 20:59:57 UTC
These patches have been pushed to 16.11.x and will be in 16.11.12.
Comment 41 Fridolin Somers 2017-09-22 15:05:29 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 42 Amit Gupta 2017-09-25 04:21:15 UTC
*** Bug 19362 has been marked as a duplicate of this bug. ***
Comment 43 Jonathan Druart 2017-09-29 15:46:11 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 44 Mason James 2017-11-23 22:02:41 UTC
Pushed to 16.05.x, for 16.05.17 release
Comment 45 Jonathan Druart 2018-06-19 20:42:07 UTC
Interesting thing: on bug 13618 it was decided to not escape the patron's messages. So maybe this will be be considered as a bug by some libraries.