Bug 19108

Summary: Stored XSS in multiple scripts
Product: Koha Reporter: Amit Gupta <amitddng135>
Component: Architecture, internals, and plumbingAssignee: Amit Gupta <amitddng135>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: amit.gupta, chris, fridolin.somers, jonathan.druart, katrin.fischer, kyle, m.de.rooy, mtj, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Small patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 14568    
Attachments: Bug 19108 - Stored XSS in oai_sets.pl
Bug 19108 - Stored XSS in items_search_fields.pl
Bug 19108 - Stored XSS in classsources.pl
Bug 19108 - Stored XSS in authtypes.pl
Bug 19108 - Stored XSS in fieldmapping.pl
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl
[SIGNED OFF] Bug 19108 - Stored XSS in oai_sets.pl
[SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl
[SIGNED OFF] Bug 19108 - Stored XSS in classsources.pl
[SIGNED OFF] Bug 19108 - Stored XSS in authtypes.pl
[SIGNED OFF] Bug 19108 - Stored XSS in fieldmapping.pl
[SIGNED OFF] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt
Bug 19108 - Stored XSS in oai_sets.pl
Bug 19108 - Stored XSS in items_search_fields.pl
Bug 19108 - Stored XSS in classsources.pl
Bug 19108 - Stored XSS in authtypes.pl
Bug 19108 - Stored XSS in fieldmapping.pl
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt
Bug 19108: (follow-up) Stored XSS in biblio_framework.pl

Description Amit Gupta 2017-08-15 08:02:49 UTC
Stored XSS in multiple scripts
Comment 1 Amit Gupta 2017-08-15 08:18:50 UTC
Stored XSS issue in

1. /cgi-bin/koha/admin/oai_sets.pl?op=new
2. /cgi-bin/koha/admin/items_search_fields.pl
Comment 2 Amit Gupta 2017-08-15 08:21:30 UTC
Created attachment 65997 [details] [review]
Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Comment 3 Amit Gupta 2017-08-15 08:22:32 UTC
Created attachment 65998 [details] [review]
Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page
Comment 4 Amit Gupta 2017-08-15 08:33:00 UTC
Created attachment 65999 [details] [review]
Bug 19108 - Stored XSS in classsources.pl

Found more page: 
/cgi-bin/koha/admin/classsources.pl

********************

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 5 Amit Gupta 2017-08-15 08:38:52 UTC
Created attachment 66000 [details] [review]
Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 6 Amit Gupta 2017-08-15 08:44:26 UTC
Created attachment 66001 [details] [review]
Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 7 Amit Gupta 2017-08-15 09:13:19 UTC
Created attachment 66002 [details] [review]
Bug 19108 - Stored XSS in biblio_framework.pl and  marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl
Comment 8 Katrin Fischer 2017-08-16 11:55:05 UTC
Created attachment 66079 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Katrin Fischer 2017-08-16 11:55:08 UTC
Created attachment 66080 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Katrin Fischer 2017-08-16 11:55:11 UTC
Created attachment 66081 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in classsources.pl

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Katrin Fischer 2017-08-16 11:55:15 UTC
Created attachment 66082 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 12 Katrin Fischer 2017-08-16 11:55:18 UTC
Created attachment 66083 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Katrin Fischer 2017-08-16 11:55:22 UTC
Created attachment 66084 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 14 Katrin Fischer 2017-08-16 11:55:25 UTC
Created attachment 66085 [details] [review]
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt

To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.
Comment 15 Marcel de Rooy 2017-08-25 06:25:22 UTC
Created attachment 66442 [details] [review]
Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 16 Marcel de Rooy 2017-08-25 06:25:30 UTC
Created attachment 66443 [details] [review]
Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 17 Marcel de Rooy 2017-08-25 06:25:39 UTC
Created attachment 66444 [details] [review]
Bug 19108 - Stored XSS in classsources.pl

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 18 Marcel de Rooy 2017-08-25 06:25:44 UTC
Created attachment 66445 [details] [review]
Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 19 Marcel de Rooy 2017-08-25 06:25:49 UTC
Created attachment 66446 [details] [review]
Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 20 Marcel de Rooy 2017-08-25 06:25:53 UTC
Created attachment 66447 [details] [review]
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 21 Marcel de Rooy 2017-08-25 06:25:59 UTC
Created attachment 66448 [details] [review]
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt

To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 22 Jonathan Druart 2017-09-12 14:03:50 UTC
We are just fixing admin scripts, not very useful.
Comment 23 Jonathan Druart 2017-09-12 14:06:59 UTC
Created attachment 67085 [details] [review]
Bug 19108: (follow-up) Stored XSS in biblio_framework.pl

Prevent software error
Template process failed: undef error - text: filter not found at
/home/vagrant/kohaclone/C4/Templates.pm line 121.
Comment 24 Katrin Fischer 2017-09-19 21:14:56 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.
Comment 25 Fridolin Somers 2017-09-22 15:05:40 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 26 Jonathan Druart 2017-09-29 15:46:45 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 27 Mason James 2017-11-23 22:03:58 UTC
Pushed to 16.05.x, for 16.05.17 release