Bug 34761

Summary: Stored/reflected XSS with searches and saved search filters
Product: Koha Reporter: Angel Metz <angelmetz05>
Component: SearchingAssignee: David Cook <dcook>
Status: CLOSED FIXED QA Contact: Marcel de Rooy <m.de.rooy>
Severity: major    
Priority: P1 - high CC: 1joynelson, angelmetz05, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, nick, tomascohen
Version: unspecified   
Hardware: All   
OS: All   
GIT URL: Change sponsored?: ---
Patch complexity: Small patch Documentation contact:
Documentation submission: Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10
Circulation function:
Bug Depends on: 17170    
Bug Blocks:    
Attachments: XSS PoC
Poc2 xss
Bug 34761: Prevent XSS for searches and saved search filters
Bug 34761: Prevent XSS for searches and saved search filters
Bug 34761: Prevent XSS for searches and saved search filters

Description Angel Metz 2023-09-12 05:10:44 UTC
Created attachment 155527 [details]
XSS PoC

Hello, how are you? I come back and make the report for the XSS vulnerability reflected in koha marc21 and koha unimarc

There is a vulnerability in the advanced search component once authenticated, the vulnerability is exploited in the same way in both software, the vulnerability is for the latest version "23.05.03" the ones to reproduce it are these

- First we log in to the platform, using the credentials that we configured during the installation.

- then we go to an advanced configuration, the endpoint is this "http://localhost:8001/cgi-bin/koha/catalogue/search.pl"

- See there in each of the checkpoints of the advanced search we place our payload

- our payload is "><script>alert(1);</script> and with this we get the xss reflected

Below I attach a screenshot of how the PoC is done
Comment 1 Angel Metz 2023-09-12 05:12:17 UTC
The vulnerability has already been reported to Miter for due process with the issue of CVE assignment, please let me know if you need any other information.
Comment 2 Angel Metz 2023-09-12 05:14:21 UTC
Created attachment 155528 [details]
Poc2 xss
Comment 3 Angel Metz 2023-09-12 05:24:22 UTC
To remedy we can do Ensure that all user inputs, including form fields, URL parameters, and cookies, are properly validated on both the client and server sides. Reject or sanitize any input that contains potentially harmful code.
Comment 4 Angel Metz 2023-09-12 06:50:37 UTC
Reported to Mitre*
Comment 5 David Cook 2023-09-12 06:55:12 UTC
Thank you, Angel for providing written details and some images. That's very helpful.

I'll take a look at this tomorrow if no one else looks at it before then.
Comment 6 Angel Metz 2023-09-12 07:00:29 UTC
Thanks to you, I am working on finding more vulnerabilities in the platform as well and reporting it to you so that you can improve security. Let me know about this XSS reflected and the assigned CVE.
Comment 7 David Cook 2023-09-13 01:45:12 UTC
Created attachment 155581 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}
Comment 9 Angel Metz 2023-09-13 07:46:25 UTC
Thank you very much for taking my report seriously, and starting to work on solving it.
Comment 10 Lucas Gass (lukeg) 2023-09-13 21:15:22 UTC
Created attachment 155598 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>
Comment 11 Marcel de Rooy 2023-09-15 06:43:13 UTC
Created attachment 155637 [details] [review]
Bug 34761: Prevent XSS for searches and saved search filters

</script> tags are interpreted in JSON strings as HTML, which can
lead to XSS attacks.

This patch puts HTML escaped JSON in the value of a hidden HTML element.
The Javascript then takes the value as a string, parses it as JSON,
and is able to use it to save search filters without triggering a
XSS attack.

This patch also adds DataTable's built-in HTML escaping for the query
and limits on the admin UI for the search filters.

Test plan:
0. Apply patch
1. Go to
http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters
2. Enable the system preference
3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
4. Click "Save search as filter"
5. Checkbox "Show in staff interface?"
6. Type "E-TEST" into box and click 'Save'
7. Go to
http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e
8. Click "E-TEST" under "Custom search filters"
9. Note that you see search results
10. Go to
http://localhost:8081/cgi-bin/koha/admin/search_filters.pl
11. Note that for "E-TEST" you see a "Query" like
{"operators":[],"operands":["e"],"indexes":[]}
12. Note that for "E-TEST" you see a "Limits" like
{"limits":[]}

Signed-off-by: Lucas Gass <lucas@bywatersolutions.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 12 Angel Metz 2023-09-17 15:40:45 UTC
Hello, the CVE has already been released, I hope the CNA has contacted you

The CVE number is CVE-2023-5025
Comment 13 Tomás Cohen Arazi (tcohen) 2023-09-25 22:09:26 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 14 David Cook 2024-02-14 03:13:09 UTC
(In reply to Angel Metz from comment #12)
> Hello, the CVE has already been released, I hope the CNA has contacted you
> 
> The CVE number is CVE-2023-5025

Hi Angel, someone has re-reported this in Koha. Can you send an update to the CNA where you lodged the CVE? It looks like this was fixed shortly after you reported it. From version 23.05.04 onward.