Description
Andreas Roussos
2018-01-24 07:12:24 UTC
Created attachment 70923 [details] [review] Bug 20083 - Information disclosure when (mis)using the MARC Preview feature The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not check whether a user is logged in or not. As a consequence, it can be used to obtain information that would normally be available to logged-in users only. For example, you can view any bibliographic record by passing a value to the 'id' argument, but you can also view records as they were imported (normally done via the 'Staged MARC management' tool). All three 17.11 installations currently listed at https://wiki.koha-community.org/wiki/Koha_Demo_Installations are affected by this issue, as demonstrated by the URLs below: http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html It should be noted that this only applies to XSLT-enabled installations. - note that I (Liz) am only putting this patch in a testable form, patch/changes written by Andreas Roussos Comment on attachment 70872 [details] [review] patch that fixes showmarc.pl Not a useable patch. Liz Rea provided one. Created attachment 70924 [details] [review] Bug 20083 - Information disclosure when (mis)using the MARC Preview feature The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not check whether a user is logged in or not. As a consequence, it can be used to obtain information that would normally be available to logged-in users only. For example, you can view any bibliographic record by passing a value to the 'id' argument, but you can also view records as they were imported (normally done via the 'Staged MARC management' tool). All three 17.11 installations currently listed at https://wiki.koha-community.org/wiki/Koha_Demo_Installations are affected by this issue, as demonstrated by the URLs below: http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html It should be noted that this only applies to XSLT-enabled installations. Made sure the author was set correctly in the patch. Have not tested it. Set the bug to arouss1980@gmail.com as he provided the patch. Created attachment 70929 [details] [review] Bug 20083 - Information disclosure when (mis)using the MARC Preview feature The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not check whether a user is logged in or not. As a consequence, it can be used to obtain information that would normally be available to logged-in users only. For example, you can view any bibliographic record by passing a value to the 'id' argument, but you can also view records as they were imported (normally done via the 'Staged MARC management' tool). All three 17.11 installations currently listed at https://wiki.koha-community.org/wiki/Koha_Demo_Installations are affected by this issue, as demonstrated by the URLs below: http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html It should be noted that this only applies to XSLT-enabled installations. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Created attachment 70931 [details] [review] Bug 20083 - Information disclosure when (mis)using the MARC Preview feature The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not check whether a user is logged in or not. As a consequence, it can be used to obtain information that would normally be available to logged-in users only. For example, you can view any bibliographic record by passing a value to the 'id' argument, but you can also view records as they were imported (normally done via the 'Staged MARC management' tool). All three 17.11 installations currently listed at https://wiki.koha-community.org/wiki/Koha_Demo_Installations are affected by this issue, as demonstrated by the URLs below: http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html It should be noted that this only applies to XSLT-enabled installations. Signed-off-by: Mark Tompsett <mtompset@hotmail.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Sure it's not the expected behaviour? How bad is that? Same fix must be provided for opac-showmarc.pl. Created attachment 71077 [details] [review] Bug 20083: Follow up - use same logic in opac-showmarc It was correctly pointed out that opac-showmarc would leak the same way as catalogue/showmarc.pl, and so this patch moves the authentication step up to the top where it should be so as to prevent inappropriate data leaks. TEST PLAN --------- 1) Set your OpacPublic system preference to Disabled 2) Open your OPAC and login 3) Find a biblio with items 4) Go to the opac details, particularly MARC view. 5) Copy the "view plain" shortcut link. 6) log out. 7) Paste the link into the address bar. -- the information will leak! 8) apply the patch 9) restart_all 10) Refresh the OPAC link -- log in screen will appear. 11) run koha qa test tools The opac-showmarc leaks far more, but both leaks are bad. You don't want people knowing that a borrower number is valid. It may be able to construct a cardnumber from it and then with study of that person social engineer or guess the password. This is particularly bad if it is an admin user. Additionally, you don't want people necessarily knowing what is in your collection, without them not being able to log in. If it is the expected behaviour, it is poor security as it does leak data. I believe these are for the best. (In reply to M. Tompsett from comment #9) > You don't want people knowing that a borrower number is valid. It may be > able to construct a cardnumber from it and then with study of that person > social engineer or guess the password. This is particularly bad if it is an > admin user. showmarc is not about borrowers ?! > Additionally, you don't want people necessarily knowing what is in your > collection, without them not being able to log in. Depends. Most libraries have an OPAC for that. But your patch depending on OpacPublic is fine with me. Created attachment 71084 [details] [review] Bug 20083: Follow up - use same logic in opac-showmarc It was correctly pointed out that opac-showmarc would leak the same way as catalogue/showmarc.pl, and so this patch moves the authentication step up to the top where it should be so as to prevent inappropriate data leaks. TEST PLAN --------- 1) Set your OpacPublic system preference to Disabled 2) Open your OPAC and login 3) Find a biblio with items 4) Go to the opac details, particularly MARC view. 5) Copy the "view plain" shortcut link. 6) log out. 7) Paste the link into the address bar. -- the information will leak! 8) apply the patch 9) restart_all 10) Refresh the OPAC link -- log in screen will appear. 11) run koha qa test tools Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Pushed to master for 18.05 Has been backported into 17.11.04 and 17.05.10 |