There's a list of bug reports dealing with CGI->param in list context and CGI->multi_param: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15747 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=15809 w/ patches https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16154 https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=16259 While those last two bugs fix a lot of the vulnerabilities, they only fix them for master. We should really work on backporting them to 3.22, 3.20, and older if necessary... as you can inject Javascript into the URL, and do all sorts of other nasty things. Here's a quick test to see if you're vulnerable in 3.22, 3.20, etc: OPAC/cgi-bin/koha/opac-search.pl?expanded_options=1&expanded_options=OPACUserJS&expanded_options=alert(%27Hello%27) This shouldn't work in master thanks to Jonathan's 16154, but older versions aren't so lucky. You might think that anyone can inject Javascript via their own browser, but you could craft a nasty piece of Javascript - put it in the URL - and then email that URL to someone. They open it and then you're executing arbitrary Javascript in their browser. I'm no security whiz, but you could probably hijack someone's session cookie that way as well. Due to the location of the vulnerability in opac-search.pl, you actually can rewrite any parameter in $template->{VARS} via $template->param(). -- There actually are some unpatched vulnerabilities in master as well. STAFFCLIENT/cgi-bin/koha/plugins/run.pl?class=Koha::Plugin::EDS&method=configure&method=IntranetUserJS&method=alert("hello"); Obviously the above is a bit more rare... you'd have to have Koha with plugins enabled and a plugin installed (the flaw is in Koha::Base, so any plugin will exhibit this vulnerability) -- There are also the following: svc/members/search: template_name => $input->param('template_path'), svc/virtualshelves/search: template_name => $input->param('template_path'), At the moment, these can't be exploited as only known keys are used, but that's only because of their location in the code. If this line was located at the end of the get_template_and_user() call, you'd be able to rewrite authnotrequired to 1, and then have unfettered access to the staff client. So can't really exploit these ones at the moment, but they're dangerous. -- Owen and Jonathan have done a good job overall... those are pretty much the only vulnerabilities I can find using Galen's technique of "git grep '=>.*->param'" to check for obvious vulnerabilities. Oh, the admin/edi_accounts.pl and admin/edi_ean_accounts.pl scripts still look vulnerable to key => value injection although the danger there doesn't look too bad. -- There is one I'm investigating right now and it's the following: C4/ILSDI/Services.pm: my $borrower = GetMember($cgi->param('id_type') => $cgi->param('id')); I think it'll allow SQL injection...
Actually it looks like /cgi-bin/koha/ilsdi.pl blocks multiple values, so that should be OK... In that case, I think that's all I've found. I'd suggest patching Koha::Plugins::Base for sure and backporting the existing patches back to 3.22 and 3.20...
Actually it looks like 3.20.3 requires a lower-cased opacuserjs: OPAC3.20.3/cgi-bin/koha/opac-search.pl?expanded_options=1&expanded_options=opacuserjs&expanded_options=alert(%27Hello%27)
Created attachment 51325 [details] [review] Bug 16476: Do not call CGI->param in list context, some more
David, I have submitted a follow-up for the master branch. For stable branches, Rmaints should backport existing fixes.
Created attachment 51347 [details] [review] Bug 16476: Do not call CGI->param in list context, some more Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Created attachment 51349 [details] [review] [PASSED QA] Bug 16476: Do not call CGI->param in list context, some more Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
(In reply to Jonathan Druart from comment #4) > David, I have submitted a follow-up for the master branch. > For stable branches, Rmaints should backport existing fixes. Thanks, Jonathan. And cheers for all the work that you and Owen have done on this one in all the other reports as well!
Pushed to master for Koha 16.05, thanks Jonathan!
Patch pushed to 3.22.x, will be in 3.22.7
Pushed to 3.20.x will be in 3.20.14