Bug 19034 - XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Summary: XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories ...
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low enhancement (vote)
Assignee: Amit Gupta
QA Contact: Tomás Cohen Arazi
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-04 04:27 UTC by Amit Gupta
Modified: 2017-09-07 06:15 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 19034 - XSS Flaws in Patron categories pages (1.18 KB, patch)
2017-08-04 05:17 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19034 - XSS Flaws in Cities (1.05 KB, patch)
2017-08-04 05:18 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration (1.39 KB, patch)
2017-08-04 05:19 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Patron categories pages (1.23 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Cities (1.10 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 19034: XSS Flaws in Z39.50/SRU servers administration (1.45 KB, patch)
2017-08-07 14:22 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 19034: (followup) Fix letters.tt XSS flaw (992 bytes, patch)
2017-08-07 14:27 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review
Bug 19034: (followup 2) Fix letters.tt XSS flaw (1.05 KB, patch)
2017-08-15 16:26 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-04 04:27:03 UTC
XSS Flaws in- Cities - Z39.50/SRU servers administration - Patron categories pages
Comment 1 Amit Gupta 2017-08-04 05:17:35 UTC
Created attachment 65485 [details] [review]
Bug 19034 - XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.
Comment 2 Amit Gupta 2017-08-04 05:18:40 UTC
Created attachment 65486 [details] [review]
Bug 19034 - XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.
Comment 3 Amit Gupta 2017-08-04 05:19:39 UTC
Created attachment 65487 [details] [review]
Bug 19034 - XSS Flaws in - Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.
Comment 4 Katrin Fischer 2017-08-04 05:23:43 UTC
Hi Amit, thx for reporting and fixing this! Please file security relevant bugs in the 'Koha security' Product, that is not generally visible until the bug is properly fixed.
Comment 5 Amit Gupta 2017-08-04 05:26:35 UTC
Hi Katrin,

Thanks!!
Comment 6 Tomás Cohen Arazi 2017-08-07 14:22:32 UTC
Created attachment 65559 [details] [review]
Bug 19034: XSS Flaws in Patron categories pages

1. Hit /cgi-bin/koha/admin/categories.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search patron categories box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search patron categories box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 7 Tomás Cohen Arazi 2017-08-07 14:22:39 UTC
Created attachment 65560 [details] [review]
Bug 19034: XSS Flaws in Cities

1. Hit /cgi-bin/koha/admin/cities.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search cities box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search cities box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 8 Tomás Cohen Arazi 2017-08-07 14:22:48 UTC
Created attachment 65561 [details] [review]
Bug 19034: XSS Flaws in Z39.50/SRU servers administration

1. Hit /cgi-bin/koha/admin/z3950servers.pl
2. Enter <IFRAME SRC="javascript:alert('XSS');"></IFRAME> search Z39.50/SRU servers box.
3. Notice the iframe is executed.
4. Apply patch.
5. Reload page, and enter iframe again on search Z39.50/SRU servers box.
6. Notice it is no longer executed.

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 9 Tomás Cohen Arazi 2017-08-07 14:27:55 UTC
Created attachment 65562 [details] [review]
Bug 19034: (followup) Fix letters.tt XSS flaw

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 10 Amit Gupta 2017-08-07 14:29:33 UTC
Thanks Tomas i am working on some other XSS issues also.
Comment 11 Tomás Cohen Arazi 2017-08-07 14:50:34 UTC
(In reply to Amit Gupta from comment #10)
> Thanks Tomas i am working on some other XSS issues also.

I've patched letter.tt here. bGreat job finding them!
Comment 12 Jonathan Druart 2017-08-15 16:26:36 UTC
Created attachment 66028 [details] [review]
Bug 19034: (followup 2) Fix letters.tt XSS flaw
Comment 13 Jonathan Druart 2017-08-29 15:07:17 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 14 Fridolin SOMERS 2017-09-05 12:44:52 UTC
Pushed to 17.05.x, is in 17.05.03
Comment 15 Katrin Fischer 2017-09-07 06:15:12 UTC
This patches have been pushed to 16.11.x and are in 16.11.11.