| Summary: | Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Kyle M Hall (khall) <kyle> |
| Component: | Templates | Assignee: | Kyle M Hall (khall) <kyle> |
| Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
| Severity: | major | ||
| Priority: | P5 - low | CC: | 1joynelson, arthur.suzuki, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, martin.renvoize, nick, tomascohen, victor, wizzyrea |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | Trivial patch |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
22.05.03, 21.11.10, 21.05.17
|
|
| Circulation function: | |||
| Bug Depends on: | 22478 | ||
| Bug Blocks: | 37595 | ||
| Attachments: |
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl )
Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) |
||
|
Description
Kyle M Hall (khall)
2022-06-15 16:06:02 UTC
Created attachment 136096 [details] [review] Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Created attachment 136289 [details] [review] Bug 30969 - Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Fixes the bug as described.. signing off Created attachment 136290 [details] [review] Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Howdi, May we have a QA on this please :) Thanking you, Liz Created attachment 136662 [details] [review] Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( opac-authorities-home.pl ) There appears to be a cross site scripting attack vulnerability in opac-authorities-home.pl, but may be accessible from any page using C4::Output::pagination_bar. https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home.pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&operator=contains&orderby=HeadingAsc&type=opac&value=1 Test Plan: 1) Use the URL above to show the XSS vulnerability exists 2) Apply this patch 3) Restart all the things! 4) Reload the page, no XSS vulnerability! Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> (In reply to Chris Cormack from comment #6) > Created attachment 136662 [details] [review] [review] > Bug 30969: Cross site scripting (XSS) attack in OPAC authority search ( > opac-authorities-home.pl ) > > There appears to be a cross site scripting attack vulnerability in > opac-authorities-home.pl, but may be accessible from any page using > C4::Output::pagination_bar. > > https://MYKOHA.LOCAL/cgi-bin/koha/opac-authorities-home. > pl?and_or=and%27%22()%26%25%3Csad%3E%3CScRiPt%20%3Ealert(document.domain)%3C/ > ScRiPt%3E&authtypecode=CORPO_NAME&excluding=1&marclist=all&op=do_search&opera > tor=contains&orderby=HeadingAsc&type=opac&value=1 > > Test Plan: > 1) Use the URL above to show the XSS vulnerability exists > 2) Apply this patch > 3) Restart all the things! > 4) Reload the page, no XSS vulnerability! > > Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com> > Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> This one missed the 22.05.01 merge. Sorry for that. Backported: Pushed to 21.05.x-security branch for 21.05.17 pushed to 21.11.x for 21.11.10, thx! Backported to 22.05.x for 22.05.03 |