Summary: | OPAC password recovery allows regexp in email | ||
---|---|---|---|
Product: | Koha | Reporter: | Fridolin Somers <fridolin.somers> |
Component: | Architecture, internals, and plumbing | Assignee: | Fridolin Somers <fridolin.somers> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | normal | ||
Priority: | P5 - low | CC: | 1joynelson, aleisha, fridolin.somers, jonathan.druart, julian.maurice, lucas, martin.renvoize, nick, victor |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=23084 | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Trivial patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
20.11.00, 20.05.06, 19.11.12, 19.05.17
|
Circulation function: | |
Bug Depends on: | 20023 | ||
Bug Blocks: | |||
Attachments: |
Bug 26904: OPAC password recovery allows regexp in email
Bug 26904: OPAC password recovery allows regexp in email Bug 26904: OPAC password recovery allows regexp in email Bug 26904: OPAC password recovery allows regexp in email |
Description
Fridolin Somers
2020-11-03 08:18:25 UTC
Created attachment 112895 [details] [review] Bug 26904: OPAC password recovery allows regexp in email When using OPAC password recovery form, opac/opac-password-recovery.pl : if one provides correct login and an email, there is a check that this email is one of patron's. This check uses RegExp with case insensitive : if ( $email && !( any { /^$email$/i } @emails ) ) This is a security issue since one can simply enter '.*'. Severity is normal because the login must be a correct. I propose to use simple string compare and remove the case insensitive. If one does only provide email address it is case sensitive. Test plan : 1) Enable system preference OpacResetPassword 2) Go to OPAC > Log in to your account > Forgot your password? 3) Enter an existing userid or cardnumber and '.*' in 'Email' 4) Without patch the password recovery is send, with patch you get the message 'No account was found with the provided information.' 5) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case 6) Without patch the password recovery is send, with patch you get the message 'No account was found with the provided information.' (In reply to Fridolin SOMERS from comment #0) > > I propose to use simple string compare and remove the case insensitive. > If one does only provide email address it is case sensitive. Oh my mistake, DB is case insensitive of actually if one does only provide email address it is case insensitive. I change my patch Created attachment 112898 [details] [review] Bug 26904: OPAC password recovery allows regexp in email When using OPAC password recovery form, opac/opac-password-recovery.pl : if one provides correct login and an email, there is a check that this email is one of patron's. This check uses RegExp with case insensitive : if ( $email && !( any { /^$email$/i } @emails ) ) This is a security issue since one can simply enter '.*'. Severity is normal because the login must be a correct. I propose to use simple string compare with lowercase to be case insensitive. Test plan : 1) Don't apply patch 2) Enable system preference 'OpacResetPassword' 3) Go to 'OPAC > Log in to your account > Forgot your password?' 4) Enter an existing userid or cardnumber and '.*' in 'Email' 5) The password recovery is created ! (check table 'borrower_password_recovery') 6) Apply patch 7) Enter an existing userid or cardnumber and '.*' in 'Email' 8) You get the message 'No account was found with the provided information.' 9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case 10) The password recovery is created (check table 'borrower_password_recovery') Created attachment 112910 [details] [review] Bug 26904: OPAC password recovery allows regexp in email When using OPAC password recovery form, opac/opac-password-recovery.pl : if one provides correct login and an email, there is a check that this email is one of patron's. This check uses RegExp with case insensitive : if ( $email && !( any { /^$email$/i } @emails ) ) This is a security issue since one can simply enter '.*'. Severity is normal because the login must be a correct. I propose to use simple string compare with lowercase to be case insensitive. Test plan : 1) Don't apply patch 2) Enable system preference 'OpacResetPassword' 3) Go to 'OPAC > Log in to your account > Forgot your password?' 4) Enter an existing userid or cardnumber and '.*' in 'Email' 5) The password recovery is created ! (check table 'borrower_password_recovery') 6) Apply patch 7) Enter an existing userid or cardnumber and '.*' in 'Email' 8) You get the message 'No account was found with the provided information.' 9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case 10) The password recovery is created (check table 'borrower_password_recovery') Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Created attachment 113223 [details] [review] Bug 26904: OPAC password recovery allows regexp in email When using OPAC password recovery form, opac/opac-password-recovery.pl : if one provides correct login and an email, there is a check that this email is one of patron's. This check uses RegExp with case insensitive : if ( $email && !( any { /^$email$/i } @emails ) ) This is a security issue since one can simply enter '.*'. Severity is normal because the login must be a correct. I propose to use simple string compare with lowercase to be case insensitive. Test plan : 1) Don't apply patch 2) Enable system preference 'OpacResetPassword' 3) Go to 'OPAC > Log in to your account > Forgot your password?' 4) Enter an existing userid or cardnumber and '.*' in 'Email' 5) The password recovery is created ! (check table 'borrower_password_recovery') 6) Apply patch 7) Enter an existing userid or cardnumber and '.*' in 'Email' 8) You get the message 'No account was found with the provided information.' 9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case 10) The password recovery is created (check table 'borrower_password_recovery') Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Julian Maurice <julian.maurice@biblibre.com> Pushed to master for 20.11, thanks to everybody involved! Oops, I pushed that one too early! IIUC it's possible to get a recovery email sent to another valid address. From the same domain or not. Which would make this more severe. $email comes from the user https://gitlab.com/koha-community/Koha/-/blob/cdbc04f69d751d2b08dc256d61972330512c3a0d/opac/opac-password-recovery.pl#L29 $email is left untouched IIUC and is used to send the recovery email. https://gitlab.com/koha-community/Koha/-/blob/cdbc04f69d751d2b08dc256d61972330512c3a0d/opac/opac-password-recovery.pl#L139 == Case 1: same domain == Email addresses can contain * in the local part. https://en.wikipedia.org/wiki/Email_address#Local-part victim email: my-non-attacker-email@example.org attacker email: my-.*-attacker-email@example.org The attacker's should match the victim's and trigger the recovery email that will be sent to the attacker's address. == Case 2: different domain == It's even simpler victim email: victim-email@example.org attacker email: victim-email@ex.mple.org Backported to 19.05.x branch for 19.05.17 backported to 20.05.x for 20.05.06 backported to 19.11.x for 19.11.12 |