Bug 23058

Summary: Cross-site scripting in OPAC search
Product: Koha Reporter: systems_analysts
Component: OPACAssignee: Jonathan Druart <jonathan.druart>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: major    
Priority: P5 - low CC: fridolin.somers, jonathan.druart, katrin.fischer, lucas, martin.renvoize, nick, wizzyrea
Version: unspecified   
Hardware: All   
OS: All   
Change sponsored?: --- Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00, 19.05.01, 18.11.07, 18.05.14
Attachments: Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Comment 1 Jonathan Druart 2019-06-05 23:42:15 UTC
Confirmed, good catch.

Hiding the URL from the description:

GET: https://catalog.kohadev.local/cgi-bin/koha/opac-search.pl?tag=ft%22%3E<script>alert(150)</script>&q=ft

ATTACK DETAILS:
This page is vulnerable to Cross-site scripting attacks.

Cross-site scripting attacks, in general, are an issue because
they are enabling attacks. Specially-crafted malicious URLs can
steal authentication tokens/cookies when a logged-in user visits them,
giving the attacker full access to that user's account in the application.
Reflected XSS attacks, in particular, are a concern as they can be used to
socially engineer a user into clicking on what appears to be a legitimate URL.
Comment 2 Jonathan Druart 2019-06-05 23:43:54 UTC
Created attachment 90342 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Comment 3 Nick Clemens 2019-06-06 12:16:43 UTC
Created attachment 90358 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Katrin Fischer 2019-06-09 20:30:07 UTC
Created attachment 90447 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Martin Renvoize 2019-07-02 07:56:47 UTC
Nice work!

Pushed to master for 19.11.00
Comment 6 Martin Renvoize 2019-07-02 08:10:21 UTC
Also pushed, and released, to stable, oldstable and oldoldstable
Comment 7 Liz Rea 2019-07-02 16:23:46 UTC
pushed to 18.05 for 18.05.14