Summary: | Stored/reflected XSS with searches and saved search filters | ||
---|---|---|---|
Product: | Koha | Reporter: | Angel Metz <angelmetz05> |
Component: | Searching | Assignee: | David Cook <dcook> |
Status: | CLOSED FIXED | QA Contact: | Marcel de Rooy <m.de.rooy> |
Severity: | major | ||
Priority: | P1 - high | CC: | 1joynelson, angelmetz05, dcook, didier.gautheron, fridolin.somers, jonathan.druart, laurent.ducos, lucas, m.de.rooy, nick, tomascohen |
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
GIT URL: | Change sponsored?: | --- | |
Patch complexity: | Small patch | Documentation contact: | |
Documentation submission: | Text to go in the release notes: | ||
Version(s) released in: |
23.11.00,23.05.04,22.11.10
|
Circulation function: | |
Bug Depends on: | 17170 | ||
Bug Blocks: | |||
Attachments: |
XSS PoC
Poc2 xss Bug 34761: Prevent XSS for searches and saved search filters Bug 34761: Prevent XSS for searches and saved search filters Bug 34761: Prevent XSS for searches and saved search filters |
Description
Angel Metz
2023-09-12 05:10:44 UTC
The vulnerability has already been reported to Miter for due process with the issue of CVE assignment, please let me know if you need any other information. Created attachment 155528 [details]
Poc2 xss
To remedy we can do Ensure that all user inputs, including form fields, URL parameters, and cookies, are properly validated on both the client and server sides. Reject or sanitize any input that contains potentially harmful code. Reported to Mitre* Thank you, Angel for providing written details and some images. That's very helpful. I'll take a look at this tomorrow if no one else looks at it before then. Thanks to you, I am working on finding more vulnerabilities in the platform as well and reporting it to you so that you can improve security. Let me know about this XSS reflected and the assigned CVE. Created attachment 155581 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]} Thank you very much for taking my report seriously, and starting to work on solving it. Created attachment 155598 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]} Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Created attachment 155637 [details] [review] Bug 34761: Prevent XSS for searches and saved search filters </script> tags are interpreted in JSON strings as HTML, which can lead to XSS attacks. This patch puts HTML escaped JSON in the value of a hidden HTML element. The Javascript then takes the value as a string, parses it as JSON, and is able to use it to save search filters without triggering a XSS attack. This patch also adds DataTable's built-in HTML escaping for the query and limits on the admin UI for the search filters. Test plan: 0. Apply patch 1. Go to http://localhost:8081/cgi-bin/koha/admin/preferences.pl?op=search&searchfield=SavedSearchFilters 2. Enable the system preference 3. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 4. Click "Save search as filter" 5. Checkbox "Show in staff interface?" 6. Type "E-TEST" into box and click 'Save' 7. Go to http://localhost:8081/cgi-bin/koha/catalogue/search.pl?q=e 8. Click "E-TEST" under "Custom search filters" 9. Note that you see search results 10. Go to http://localhost:8081/cgi-bin/koha/admin/search_filters.pl 11. Note that for "E-TEST" you see a "Query" like {"operators":[],"operands":["e"],"indexes":[]} 12. Note that for "E-TEST" you see a "Limits" like {"limits":[]} Signed-off-by: Lucas Gass <lucas@bywatersolutions.com> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Hello, the CVE has already been released, I hope the CNA has contacted you The CVE number is CVE-2023-5025 Pushed to master for 23.11. Nice work everyone, thanks! (In reply to Angel Metz from comment #12) > Hello, the CVE has already been released, I hope the CNA has contacted you > > The CVE number is CVE-2023-5025 Hi Angel, someone has re-reported this in Koha. Can you send an update to the CNA where you lodged the CVE? It looks like this was fixed shortly after you reported it. From version 23.05.04 onward. |