Bug 23058

Summary:	Cross-site scripting in OPAC search
Product:	Koha	Reporter:	systems_analysts
Component:	OPAC	Assignee:	Jonathan Druart <jonathan.druart>
Status:	CLOSED FIXED	QA Contact:	Testopia <testopia>
Severity:	major
Priority:	P5 - low	CC:	fridolin.somers, jonathan.druart, lucas, martin.renvoize, nick, wizzyrea
Version:	unspecified
Hardware:	All
OS:	All
Change sponsored?:	---	Patch complexity:	Trivial patch
Documentation contact:		Documentation submission:
Text to go in the release notes:		Version(s) released in:	19.11.00, 19.05.01, 18.11.07, 18.05.14
Circulation function:
Attachments:	Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Comment 1 Jonathan Druart 2019-06-05 23:42:15 UTC

Confirmed, good catch.

Hiding the URL from the description:

GET: https://catalog.kohadev.local/cgi-bin/koha/opac-search.pl?tag=ft%22%3E<script>alert(150)</script>&q=ft

ATTACK DETAILS:
This page is vulnerable to Cross-site scripting attacks.

Cross-site scripting attacks, in general, are an issue because
they are enabling attacks. Specially-crafted malicious URLs can
steal authentication tokens/cookies when a logged-in user visits them,
giving the attacker full access to that user's account in the application.
Reflected XSS attacks, in particular, are a concern as they can be used to
socially engineer a user into clicking on what appears to be a legitimate URL.

Comment 2 Jonathan Druart 2019-06-05 23:43:54 UTC

Created attachment 90342 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Comment 3 Nick Clemens (kidclamp) 2019-06-06 12:16:43 UTC

Created attachment 90358 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Comment 4 Katrin Fischer 2019-06-09 20:30:07 UTC

Created attachment 90447 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Comment 5 Martin Renvoize (ashimema) 2019-07-02 07:56:47 UTC

Nice work!

Pushed to master for 19.11.00

Comment 6 Martin Renvoize (ashimema) 2019-07-02 08:10:21 UTC

Also pushed, and released, to stable, oldstable and oldoldstable

Comment 7 Liz Rea 2019-07-02 16:23:46 UTC

pushed to 18.05 for 18.05.14