Summary: | opac-shelves.pl vulnerable to Cross-site scripting attacks | ||
---|---|---|---|
Product: | Koha | Reporter: | gbarna |
Component: | Architecture, internals, and plumbing | Assignee: | Jonathan Druart <jonathan.druart> |
Status: | CLOSED FIXED | QA Contact: | David Cook <dcook> |
Severity: | major | ||
Priority: | P3 | CC: | dcook, fridolin.somers, jonathan.druart, katrin.fischer, nick, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
21.05.00,20.11.06,20.05.12,19.11.18
|
|
Bug Depends on: | |||
Bug Blocks: | 28409 | ||
Attachments: |
Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl Bug 20982: Comprehensively validate category in opac-shelves.pl |
Description
gbarna
2018-06-21 19:43:15 UTC
This was partially fixed in bug 19333 This error is coming from the paging (only can recreate when you have a list big enough to have multiple pages of results) Any ETA on this bug? Our security scanner keeps flagging the vulnerability. Created attachment 121209 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl *** Bug 28398 has been marked as a duplicate of this bug. *** Created attachment 121258 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Apply the patch & restart services 4. Repeat the above and you are not redirected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> It seems to work :D By testing with only the client and the server part, we can see that each of them is enough to fix. And more importantly that the server part is enough. So a compromised client can't bypass the fix. Thanks David for the test plan. Is that enough to test the vulnerability? I couldn't exploit with the example in this ticket. Yeah looks good to me, Victor. I'll QA it shortly. So there are other places where the category should be validated. However, I think we've done enough for this particular bug. I think that other validation is out of scope. Created attachment 121264 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Apply the patch & restart services 4. Repeat the above and you are not redirected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: David Cook <dcook@prosentient.com.au> *** Bug 28409 has been marked as a duplicate of this bug. *** Actually, it makes sense to validate it more comprehensively here... Created attachment 121266 [details] [review] Bug 20982: Comprehensively validate category in opac-shelves.pl Default to a category of 1 (ie Private). Only allow input of 1 or 2 (ie Public) == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=foo&category=9 4. Note that you can't see this list in the Lists (but it has been added to the database) 5. Apply the patch & restart services 6. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 7. Note that you are not redirected to another website 8. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=bar&category=9 9. Note that "bar" has been added as a Private list Thanks for the follow-up, David. I am reopening bug 28409 and moving your patch there. I have another follow-up and maybe more work is needed so I don't think it should be done here. So, passed QA for this one? Current version applies and work on 19.11.x (In reply to Victor Grousset/tuxayo from comment #14) > So, passed QA for this one? Yep! > Yep!
Ok, so backported in my local secret 19.11.x branch ^^
Pushed to master for 21.05, thanks to everybody involved! |