| Summary: | paycollect.pl is vulnerable for CSRF attacks | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jiaky Ooi <jiakyooi95> |
| Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
| Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | fridolin.somers, jon.turner, jonathan.druart, m.de.rooy, mtj |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: | ||
| Circulation function: | |||
| Bug Depends on: | |||
| Bug Blocks: | 17096 | ||
| Attachments: |
html file for PoC
Bug 19117: Add CSRF protection to paycollect.pl Bug 19117: Add CSRF protection to paycollect.pl Bug 19117: Add CSRF protection to paycollect.pl |
||
|
Description
Jiaky Ooi
2017-08-15 16:26:20 UTC
Yes, all the forms are vulnerable for CSRF attacks, only the following scripts are fixed: authorities/authorities-home.pl authorities/detail.pl basket/sendbasket.pl members/deletemem.pl members/member-flags.pl members/member-password.pl members/memberentry.pl members/moremember.pl opac/opac-memberentry.pl opac/opac-sendbasket.pl opac/sco/sco-main.pl opac/sco/sco-patron-image.pl tools/import_borrowers.pl tools/picture-upload.pl Thanks for the prompt reply, just a verification please. Would this mean that this will not be a 0day bug and we would require to implement custom CSRF countermeasures? It is a known bug (at least by me).
With my answer I wanted to tell that the vulnerability is not specific to members/paycollect.pl, several other scripts are impacted.
We first fixed the forms that had a big impacts on the patron data and security (change of password, patron's detail, permissions, deletion of a patron's entry, etc.) as well as all forms of the public interface (OPAC).
It is on my todo list, but I am not considering it as high priority for now.
> Would this mean that this will not be a 0day bug and we would require to
> implement custom CSRF countermeasures?
If you implement such fixes, please share them with us :)
(In reply to Jonathan Druart from comment #3) > It is a known bug (at least by me). > > With my answer I wanted to tell that the vulnerability is not specific to > members/paycollect.pl, several other scripts are impacted. > > We first fixed the forms that had a big impacts on the patron data and > security (change of password, patron's detail, permissions, deletion of a > patron's entry, etc.) as well as all forms of the public interface (OPAC). > > It is on my todo list, but I am not considering it as high priority for now. > > > Would this mean that this will not be a 0day bug and we would require to > > implement custom CSRF countermeasures? > > If you implement such fixes, please share them with us :) Apologies if I caused any misunderstanding. We are not a KOHA library user. We are a pen testing company that found this vulnerability while performing a pen test for a client. The previous question was intended to ask if the client should implement their own workaround or should they wait on a stable release from KOHA. As this is a known issue as mentioned on your previous comment, was I the first to report this issue to KOHA? And are there any CVE numbers reserved or assigned to this issue? (In reply to Jiaky Ooi from comment #4) > The previous question was intended to ask if the client should implement > their own workaround or should they wait on a stable release from KOHA. What would be a workaround? As I told you earlier it is on my list, but I do not know when I will have time to dedicate to this issue. > As this is a known issue as mentioned on your previous comment, was I the > first to report this issue to KOHA? And are there any CVE numbers reserved > or assigned to this issue? There are no CVE reserved. paycollect.pl is only one of the several scripts that are vulnerable for CSRF attacks. Created attachment 67616 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab. Created attachment 67800 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Created attachment 68043 [details] [review] Bug 19117: Add CSRF protection to paycollect.pl Security bug, trivial changes, no need to provide procedure for script kiddies. Test plan: Pay fines using the different options from the "Pay fines" tab. Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 17.11, thanks to everybody involved! This patch has been pushed to 16.11.x and will be in 16.11.13. These patches have been pushed to 17.05.x and are in 17.05.05. Pushed to 16.05.x, for 16.05.18 release |