Bug 40766

Summary: Reflected XSS in set-library.pl
Product: Koha Reporter: oos3c
Component: Architecture, internals, and plumbingAssignee: Jonathan Druart <jonathan.druart>
Status: Needs documenting --- QA Contact: Marcel de Rooy <m.de.rooy>
Severity: normal    
Priority: P5 - low CC: dcook, didier.gautheron, fridolin.somers, jonathan.druart, katrin.fischer, laurent.ducos, lisette, lucas, m.de.rooy, martin.renvoize, nick, phil, philippe.blouin, tomascohen, wainuiwitikapark
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=37828
GIT URL: Initiative type: ---
Sponsorship status: --- Comma delimited list of Sponsors:
Crowdfunding goal: 0 Patch complexity: Trivial patch
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.04,24.11.09,24.05.12,22.11.31
Circulation function:
Attachments: Reflected XSS within oldrefer paramater
Bug 40766: Prevent XSS on set-library
Bug 40766: Prevent XSS on set-library
Bug 40766: Prevent XSS on set-library
Bug 40766: (QA follow-up) Operator precedence, quoting
Bug 40766: [24.05.x] Prevent XSS on set-library

Description oos3c 2025-09-08 09:30:30 UTC
Created attachment 186256 [details]
Reflected XSS within oldrefer paramater

Hi team,

A reflected XSS vulnerability was discovered within the oldrefer parameter of set-library.pl within the admin portal of Koha.

If an authenticated user follows the below URL, arbitrary JavaScript can be executed:

http://test-intra.kohapoc/cgi-bin/koha/circ/set-library.pl?oldreferer="><script>alert('xss')</script>

It appears to be due to unsanitised input reflected in both line 98 and 101 of set-library.tt:

<a class="cancel" id="cancel_set_library" href="[% referer or '/cgi-bin/koha/mainpage.pl' %]">Cancel</a>

<input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/mainpage.pl" %]" />

I have attached a POC screenshot.
Comment 1 Jonathan Druart 2025-09-08 14:06:20 UTC
Created attachment 186260 [details] [review]
Bug 40766: Prevent XSS on set-library
Comment 2 David Cook 2025-09-10 03:35:08 UTC
Created attachment 186306 [details] [review]
Bug 40766: Prevent XSS on set-library

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 3 oos3c 2025-09-17 12:22:42 UTC
I believe the fix proposed is sufficient. Thanks.
Comment 4 Marcel de Rooy 2025-09-19 06:21:37 UTC
Looking here
Comment 5 Marcel de Rooy 2025-09-19 06:33:40 UTC
Created attachment 186599 [details] [review]
Bug 40766: Prevent XSS on set-library

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Marcel de Rooy 2025-09-19 06:33:43 UTC
Created attachment 186600 [details] [review]
Bug 40766: (QA follow-up) Operator precedence, quoting

Adding parentheses since I was not sure about precedence here. The filter
should be applied to the whole expression.
Adjusted double to single quotes in the second change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Fridolin Somers 2025-09-23 12:14:25 UTC
Pushed to 24.11.x-security for 24.11.09
Comment 8 Wainui Witika-Park 2025-09-24 07:50:45 UTC
Pushed to 22.11.x for 22.11.31
Comment 9 Lucas Gass (lukeg) 2025-09-25 16:42:15 UTC
Created attachment 186925 [details] [review]
Bug 40766: [24.05.x] Prevent XSS on set-library