Bug 16593 - Access Control - Malicious user can delete the search history of another user
Summary: Access Control - Malicious user can delete the search history of another user
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on: 11430
Blocks:
  Show dependency treegraph
 
Reported: 2016-05-25 16:54 UTC by am
Modified: 2019-06-27 09:24 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 16593: Do not allow patrons to delete search history of others patrons (2.06 KB, patch)
2016-05-26 10:57 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 16593: Do not allow patrons to delete search history of others patrons (2.12 KB, patch)
2016-05-26 11:20 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16593: Do not allow patrons to delete search history of others patrons (2.17 KB, patch)
2016-06-17 16:32 UTC, Kyle M Hall
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description am 2016-05-25 16:54:54 UTC
A malicious user can delete the search history of all other users by correctly guessing the ID value assigned to the victim's search. As searches are assigned values sequentially, an attacker could quickly remove the searches belonging to all of the application's users. 

eg

This GET request, providing the attacker is authenticated, will delete the search assigned with the value 100, even if this search was not their own:


https://localhost/cgi-bin/koha/opac-search-history.pl?action=delete&id=100

Please confirm this issue and credit Alex Middleton at Dionach in any security advisory. Thanks.
Comment 1 Jonathan Druart 2016-05-26 10:57:45 UTC Comment hidden (obsolete)
Comment 2 Chris Cormack 2016-05-26 11:20:05 UTC Comment hidden (obsolete)
Comment 3 Kyle M Hall 2016-06-17 16:32:53 UTC
Created attachment 52494 [details] [review]
Bug 16593: Do not allow patrons to delete search history of others patrons

A malicious user can delete the search history of all other users by
correctly guessing the ID value assigned to the victim's search. As
searches are assigned values sequentially, an attacker could quickly
remove the searches belonging to all of the application's users.

To reproduce:
Login with patron A
launch a search
Note the id generated for this search history:
select id from search_history order by id desc limit 1;
Login with patron B
Hit /cgi-bin/koha/opac-search-history.pl?action=delete&id=<ID>
Note that the row is deleted in the DB

Test plan
Confirm that this patch fixes the issue.
The same test can be made at the staff interface

Reported by Alex Middleton at Dionach

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Comment 4 Kyle M Hall 2016-06-24 11:47:35 UTC
Pushed to master for 16.11, thanks Jonathan!
Comment 5 Frédéric Demians 2016-08-01 11:49:33 UTC
Pushed in 16.05. Will be in 16.05.02.
Comment 6 Chris Cormack 2016-08-03 20:27:13 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 7 Julian Maurice 2016-08-16 12:22:23 UTC
Patch pushed to 3.22.x, will be in 3.22.10