Bug 13510 - Cross site scripting in opac lists
Summary: Cross site scripting in opac lists
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low blocker (vote)
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-05 01:08 UTC by Carlos Córdova
Modified: 2015-12-03 22:02 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Scan Acunetix (339.53 KB, application/pdf)
2015-01-05 01:08 UTC, Carlos Córdova
Details
Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves (17.41 KB, patch)
2015-01-05 05:07 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves (17.62 KB, patch)
2015-01-05 06:13 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 13510 : Fixing the third XSS issue (1.47 KB, patch)
2015-01-05 06:41 UTC, Chris Cormack
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves (17.72 KB, patch)
2015-01-05 08:41 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 13510 : Fixing the third XSS issue (1.54 KB, patch)
2015-01-05 08:41 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves (17.78 KB, patch)
2015-01-05 08:46 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves (17.78 KB, patch)
2015-01-05 08:46 UTC, Martin Renvoize
Details | Diff | Splinter Review
[PASSED QA] Bug 13510 : Fixing the third XSS issue (1.59 KB, patch)
2015-01-05 08:47 UTC, Martin Renvoize
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Córdova 2015-01-05 01:08:53 UTC
Created attachment 34921 [details]
Scan Acunetix

accunetix made with text
koha version: 3.18.02
s.o : Ubuntu Server

***********************************************
scan start
******************************
CVSS
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
CWE-79
CWE
Affected items
/cgi-bin/koha/opac-downloadshelf.pl
/cgi-bin/koha/opac-shelves.pl
/cgi-bin/koha/opac-topissues.pl
Comment 4 Chris Cormack 2015-01-05 01:38:04 UTC
Thanks Carlos, will investigate further.  

You are running the latest version of master (or 3.18.x or 3.16.x) eh?
Comment 5 Chris Cormack 2015-01-05 01:42:42 UTC
I will work on this tonight, unless someone beats me to it. carlos you might want to try to fix it.  It will be a missing |html or |uri in the template file.
Comment 6 Carlos Córdova 2015-01-05 01:47:06 UTC
we are using 3.18.02 en ubuntu server
Comment 7 Chris Cormack 2015-01-05 02:10:05 UTC
Ah yes, it's only in the bootstrap theme. These errors crept in with the bootstrap templates. So anything running bootstrap (3.16.x up) will be vulnerable.

Ill do a patch tonight.

Thanks again Carlos, please do report if you spot anything else.
Comment 8 Liz Rea 2015-01-05 05:07:19 UTC Comment hidden (obsolete)
Comment 9 Liz Rea 2015-01-05 05:08:00 UTC
I wasn't able to replicate the 3rd case, but I think I sorted the first two.

Cheers,
Liz
Comment 10 Chris Cormack 2015-01-05 06:13:51 UTC Comment hidden (obsolete)
Comment 11 Chris Cormack 2015-01-05 06:37:10 UTC
I can recreate the third issue.

You have to have some items with items.issue not null. and then a url like

http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E

Will do it.

Working on a patch now
Comment 12 Chris Cormack 2015-01-05 06:41:10 UTC Comment hidden (obsolete)
Comment 13 Katrin Fischer 2015-01-05 08:41:35 UTC Comment hidden (obsolete)
Comment 14 Katrin Fischer 2015-01-05 08:41:47 UTC Comment hidden (obsolete)
Comment 15 Martin Renvoize 2015-01-05 08:46:17 UTC Comment hidden (obsolete)
Comment 16 Martin Renvoize 2015-01-05 08:46:51 UTC
Created attachment 34931 [details] [review]
[PASSED QA] Bug 13510 - Cross site scripting bug in opac-downloadshelf and opac-shelves

A specially crafted url causes XSS in Koha

To test:

cgi-bin/koha/opac-shelves.pl?viewshelf=2%22%3E%3Cscript%3Eprompt(987898)%3C/script%3E

cgi-bin/koha/opac-downloadshelf.pl?shelfid=2%22%3Cscript%3Eprompt(1)%3C/script%3E&showprivateshelves

These should cause a popup without the patch. With the patch, no popup.

You may need to create these lists, the xss will not be triggered if the list doesn't exist or you don't
have permission to view them.

Signed-off-by: Chris <chris@bigballofwax.co.nz>

Fixes the two listed problems

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed patch fixes the problem.

Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 17 Martin Renvoize 2015-01-05 08:47:13 UTC
Created attachment 34932 [details] [review]
[PASSED QA] Bug 13510 : Fixing the third XSS issue

To test

1/ Make sure you have some items in your database, that have values in items.issue
If nessecary do something like

UPDATE items SET issues = 10 WHERE itemnumber=somenumber

2/ Hit a url like http://localhost:8080/cgi-bin/koha/opac-topissues.pl?do_it=1&timeLimit=3%3Cscript%3Eprompt%28924513%29%3C/script%3E

3/ Notice you will get a prompt
4/ Apply patch
5/ Test again

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Martin Renvoize <martin.renvoize@ptfs-europe.com>
Comment 18 Tomás Cohen Arazi 2015-01-22 19:45:19 UTC
Patches pushed to master.

Thanks Liz and Chris!
Comment 19 Chris Cormack 2015-01-22 19:45:59 UTC
Pushed to 3.18.x will be in 3.18.3
Comment 20 Fridolin SOMERS 2015-01-23 09:24:04 UTC
Pushed to 3.14.x will be in 3.14.13
Comment 21 Mason James 2015-04-22 08:37:41 UTC
Pushed to 3.16.x will be in 3.16.7