Bug 14360 - XSS Injection point
Summary: XSS Injection point
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Aleisha Amohia
QA Contact: Chris Cormack
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-07 14:51 UTC by Vincent
Modified: 2016-12-05 21:23 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 14360: Unescaped variable causes alert (3.55 KB, patch)
2015-06-08 04:57 UTC, Aleisha Amohia
Details | Diff | Splinter Review
Bug 14360: Unescaped variable causes alert pop-up (1.98 KB, patch)
2015-06-09 04:25 UTC, Aleisha Amohia
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14360: Unescaped variable causes alert (3.62 KB, patch)
2015-06-09 21:38 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 14360: Unescaped variable causes alert pop-up (2.04 KB, patch)
2015-06-09 21:38 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14360: Unescaped variable causes alert (3.66 KB, patch)
2015-06-10 13:16 UTC, Kyle M Hall
Details | Diff | Splinter Review
[PASSED QA] Bug 14360: Unescaped variable causes alert pop-up (2.09 KB, patch)
2015-06-10 13:16 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Vincent 2015-06-07 14:51:00 UTC
Got injection point in some query like :

opac-authorities-home.pl?op=do_search&resultsperpage=1"><script>alert(document.cookie)</script>

But another funny is to create a list with a js code in the name and it will be readen on delet like :

<script>alert(document.cookie);</script>

I didn't try all the $ for injection point but i think you should bullet proof it with an sqlmap on all of them. And to test some scan with kali's tool or ask for someone who can use them to bullet proof it. 

Regards.

Vincent.
Comment 1 Katrin Fischer 2015-06-07 19:59:55 UTC
Vincent helped me out on IRC with a link that makes the first problem visible on Bywater's demo installation (3.19...):

http://catalog.bywatersolutions.com/cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Comment 2 Katrin Fischer 2015-06-07 20:17:26 UTC
For the second issue:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'

Tested on current master.
Comment 3 Aleisha Amohia 2015-06-08 04:57:02 UTC Comment hidden (obsolete)
Comment 4 Aleisha Amohia 2015-06-09 04:25:04 UTC Comment hidden (obsolete)
Comment 5 Katrin Fischer 2015-06-09 21:38:05 UTC Comment hidden (obsolete)
Comment 6 Katrin Fischer 2015-06-09 21:38:18 UTC Comment hidden (obsolete)
Comment 7 Katrin Fischer 2015-06-09 21:42:38 UTC
Can we get some QA on this next please? :)
Comment 8 Kyle M Hall 2015-06-10 13:16:14 UTC
Created attachment 40066 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert

Adding |html to [% resultsperpage %] to escape the variable and get rid of the alert.

To test:

1) Go to URL such as ...  /cgi-bin/koha/opac-authorities-home.pl?op=do_search&resultsperpage=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
2) Notice pop-up box with alert
3) Apply patch, refresh page
4) Notice alert is gone

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 9 Kyle M Hall 2015-06-10 13:16:21 UTC
Created attachment 40067 [details] [review]
[PASSED QA] Bug 14360: Unescaped variable causes alert pop-up

To test:

1) Create a list in the OPAC, name it: <script>alert('Hello');</script>
2) Delete the list
3) Confirm deletion
4) See the alert say 'Hello'
5) Apply patch
6) Recreate list with same name
7) Delete list
8) Confirm deletion and alert no longer pops up

Signed-off-by: Katrin Fischer <Katrin.Fischer.83@web.de>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 10 Tomás Cohen Arazi 2015-06-11 13:18:01 UTC
Patches pushed to master.

Thanks Aleisha!
Comment 11 Chris Cormack 2015-06-11 20:11:47 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 12 Chris Cormack 2015-06-17 22:32:50 UTC
Mason and liz you might want to take a look at this one
Comment 13 Liz Rea 2015-06-19 04:07:42 UTC
I have this in my branch for 3.18. I still can't seem to get my keys to work for git.koha-community.org.
Comment 14 Liz Rea 2015-06-23 01:57:20 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 15 Fridolin SOMERS 2015-06-23 09:42:56 UTC
Pushed to 3.14.x, will be in 3.14.16