Bug 19117

Summary: paycollect.pl is vulnerable for CSRF attacks
Product: Koha Reporter: Jiaky Ooi <jiakyooi95>
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P5 - low CC: fridolin.somers, jon.turner, jonathan.druart, katrin.fischer, m.de.rooy, mtj
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
Bug Depends on:    
Bug Blocks: 17096    
Attachments: html file for PoC
Bug 19117: Add CSRF protection to paycollect.pl
Bug 19117: Add CSRF protection to paycollect.pl
Bug 19117: Add CSRF protection to paycollect.pl

Description Jiaky Ooi 2017-08-15 16:26:20 UTC
Created attachment 66027 [details]
html file for PoC

The following issues were identified, Koha was installed on ubuntu 16.04 and mySQL with default configuration:

Vulnerability Type: Cross-site request forgery
Affected Product: koha library system
Tested Version: 17.05.02
Discovered by: Jiaky Ooi
Affected URL: 1) /cgi-bin/koha/members/paycollect.pl
Affected Parameter: borrowernumber, amount, amountoutstanding, paid


Please be aware that we will publish these vulnerability on the disclosure date when agreed.

Please reserve CVE number for this vulnerability by contacting Mitre. Further information can be found at https://cve.mitre.org/cve/request_id.html 

Please see attached for html payload used for PoC.

Many thanks

_________________________________________________________

Jiaky Ooi | Consultant

Oxford        +44 (0)1865 877 830
Dubai          +971 (0)4 427 0428  
London       +44 (0)203 5983740
New York    +1 646-781-7580

E-Mail        jiaky.ooi@dionach.com 
Web          www.dionach.com
Comment 1 Jonathan Druart 2017-08-15 17:34:15 UTC
Yes, all the forms are vulnerable for CSRF attacks, only the following scripts are fixed:

authorities/authorities-home.pl
authorities/detail.pl
basket/sendbasket.pl
members/deletemem.pl
members/member-flags.pl
members/member-password.pl
members/memberentry.pl
members/moremember.pl
opac/opac-memberentry.pl
opac/opac-sendbasket.pl
opac/sco/sco-main.pl
opac/sco/sco-patron-image.pl
tools/import_borrowers.pl
tools/picture-upload.pl
Comment 2 Jiaky Ooi 2017-08-15 20:26:07 UTC
Thanks for the prompt reply, just a verification please.

Would this mean that this will not be a 0day bug and we would require to implement custom CSRF countermeasures?
Comment 3 Jonathan Druart 2017-08-15 21:01:13 UTC
It is a known bug (at least by me).

With my answer I wanted to tell that the vulnerability is not specific to members/paycollect.pl, several other scripts are impacted.

We first fixed the forms that had a big impacts on the patron data and security (change of password, patron's detail, permissions, deletion of a patron's entry, etc.) as well as all forms of the public interface (OPAC).

It is on my todo list, but I am not considering it as high priority for now.

> Would this mean that this will not be a 0day bug and we would require to
> implement custom CSRF countermeasures?

If you implement such fixes, please share them with us :)
Comment 4 Jiaky Ooi 2017-08-16 13:23:33 UTC
(In reply to Jonathan Druart from comment #3)
> It is a known bug (at least by me).
> 
> With my answer I wanted to tell that the vulnerability is not specific to
> members/paycollect.pl, several other scripts are impacted.
> 
> We first fixed the forms that had a big impacts on the patron data and
> security (change of password, patron's detail, permissions, deletion of a
> patron's entry, etc.) as well as all forms of the public interface (OPAC).
> 
> It is on my todo list, but I am not considering it as high priority for now.
> 
> > Would this mean that this will not be a 0day bug and we would require to
> > implement custom CSRF countermeasures?
> 
> If you implement such fixes, please share them with us :)

Apologies if I caused any misunderstanding. We are not a KOHA library user. We are a pen testing company that found this vulnerability while performing a pen test for a client.

The previous question was intended to ask if the client should implement their own workaround or should they wait on a stable release from KOHA.

As this is a known issue as mentioned on your previous comment, was I the first to report this issue to KOHA? And are there any CVE numbers reserved or assigned to this issue?
Comment 5 Jonathan Druart 2017-08-22 16:10:44 UTC
(In reply to Jiaky Ooi from comment #4)
> The previous question was intended to ask if the client should implement
> their own workaround or should they wait on a stable release from KOHA.

What would be a workaround?
As I told you earlier it is on my list, but I do not know when I will have time to dedicate to this issue.

> As this is a known issue as mentioned on your previous comment, was I the
> first to report this issue to KOHA? And are there any CVE numbers reserved
> or assigned to this issue?

There are no CVE reserved.
paycollect.pl is only one of the several scripts that are vulnerable for CSRF attacks.
Comment 6 Jonathan Druart 2017-10-04 20:51:50 UTC
Created attachment 67616 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.
Comment 7 Katrin Fischer 2017-10-07 13:24:52 UTC
Created attachment 67800 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Marcel de Rooy 2017-10-13 05:45:42 UTC
Created attachment 68043 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Jonathan Druart 2017-10-27 17:19:43 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 10 Katrin Fischer 2017-10-29 16:35:53 UTC
This patch has been pushed to 16.11.x and will be in 16.11.13.
Comment 11 Fridolin Somers 2017-11-08 08:22:10 UTC
These patches have been pushed to 17.05.x and are in 17.05.05.
Comment 12 Mason James 2017-11-23 23:17:50 UTC
Pushed to 16.05.x, for 16.05.18 release