Bug 19108 - Stored XSS in multiple scripts
Summary: Stored XSS in multiple scripts
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Amit Gupta
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 14568
  Show dependency treegraph
 
Reported: 2017-08-15 08:02 UTC by Amit Gupta
Modified: 2017-10-03 07:58 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 19108 - Stored XSS in oai_sets.pl (4.04 KB, patch)
2017-08-15 08:21 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in items_search_fields.pl (3.98 KB, patch)
2017-08-15 08:22 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in classsources.pl (1.88 KB, patch)
2017-08-15 08:33 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in authtypes.pl (1.35 KB, patch)
2017-08-15 08:38 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in fieldmapping.pl (1.32 KB, patch)
2017-08-15 08:44 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl (8.92 KB, patch)
2017-08-15 09:13 UTC, Amit Gupta
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in oai_sets.pl (4.12 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl (4.09 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in classsources.pl (1.95 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in authtypes.pl (1.42 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in fieldmapping.pl (1.39 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
[SIGNED OFF] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl (8.99 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt (3.87 KB, patch)
2017-08-16 11:55 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in oai_sets.pl (4.20 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in items_search_fields.pl (4.17 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in classsources.pl (2.03 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in authtypes.pl (1.50 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in fieldmapping.pl (1.50 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl (9.07 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt (3.97 KB, patch)
2017-08-25 06:25 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 19108: (follow-up) Stored XSS in biblio_framework.pl (1.50 KB, patch)
2017-09-12 14:06 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Amit Gupta 2017-08-15 08:02:49 UTC
Stored XSS in multiple scripts
Comment 1 Amit Gupta 2017-08-15 08:18:50 UTC
Stored XSS issue in

1. /cgi-bin/koha/admin/oai_sets.pl?op=new
2. /cgi-bin/koha/admin/items_search_fields.pl
Comment 2 Amit Gupta 2017-08-15 08:21:30 UTC
Created attachment 65997 [details] [review]
Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped
Comment 3 Amit Gupta 2017-08-15 08:22:32 UTC
Created attachment 65998 [details] [review]
Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page
Comment 4 Amit Gupta 2017-08-15 08:33:00 UTC
Created attachment 65999 [details] [review]
Bug 19108 - Stored XSS in classsources.pl

Found more page: 
/cgi-bin/koha/admin/classsources.pl

********************

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 5 Amit Gupta 2017-08-15 08:38:52 UTC
Created attachment 66000 [details] [review]
Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 6 Amit Gupta 2017-08-15 08:44:26 UTC
Created attachment 66001 [details] [review]
Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped
Comment 7 Amit Gupta 2017-08-15 09:13:19 UTC
Created attachment 66002 [details] [review]
Bug 19108 - Stored XSS in biblio_framework.pl and  marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl
Comment 8 Katrin Fischer 2017-08-16 11:55:05 UTC
Created attachment 66079 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 9 Katrin Fischer 2017-08-16 11:55:08 UTC
Created attachment 66080 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 10 Katrin Fischer 2017-08-16 11:55:11 UTC
Created attachment 66081 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in classsources.pl

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 11 Katrin Fischer 2017-08-16 11:55:15 UTC
Created attachment 66082 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 12 Katrin Fischer 2017-08-16 11:55:18 UTC
Created attachment 66083 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 13 Katrin Fischer 2017-08-16 11:55:22 UTC
Created attachment 66084 [details] [review]
[SIGNED OFF] Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 14 Katrin Fischer 2017-08-16 11:55:25 UTC
Created attachment 66085 [details] [review]
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt

To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.
Comment 15 Marcel de Rooy 2017-08-25 06:25:22 UTC
Created attachment 66442 [details] [review]
Bug 19108 - Stored XSS in oai_sets.pl

To Test
1. Hit the page /cgi-bin/koha/admin/oai_sets.pl
2. Click on New set
3. Add a text in the field setSpec, setName that contains js
4. Save the page.
5. Notice js is execute
6. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 16 Marcel de Rooy 2017-08-25 06:25:30 UTC
Created attachment 66443 [details] [review]
Bug 19108 - Stored XSS in items_search_fields.pl

To Test
1. Hit the page /cgi-bin/koha/admin/items_search_fields.pl
2. Add a text in the field Name and Label that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Fixed for new and edit page

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 17 Marcel de Rooy 2017-08-25 06:25:39 UTC
Created attachment 66444 [details] [review]
Bug 19108 - Stored XSS in classsources.pl

Fixed for both Classification sources & Classification filing rules

To Test
1. first case classification source: Hit the page
   /cgi-bin/koha/admin/classsources.pl?op=add_source
   second case classification filing rules:
   Hit the page /cgi-bin/koha/admin/classsources.pl?op=add_sort_rule
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 18 Marcel de Rooy 2017-08-25 06:25:44 UTC
Created attachment 66445 [details] [review]
Bug 19108 - Stored XSS in authtypes.pl

To Test
1. Hit the page /cgi-bin/koha/admin/authtypes.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 19 Marcel de Rooy 2017-08-25 06:25:49 UTC
Created attachment 66446 [details] [review]
Bug 19108 - Stored XSS in fieldmapping.pl

To Test
1. Hit the page /cgi-bin/koha/admin/fieldmapping.pl
2. Add a text in the field Field name that contains js
3. Save the page.
4. Notice js is execute
5. Apply patch and reload, the js is escaped

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 20 Marcel de Rooy 2017-08-25 06:25:53 UTC
Created attachment 66447 [details] [review]
Bug 19108 - Stored XSS in biblio_framework.pl and marctagstructure.pl

To Test
1. Hit the page /cgi-bin/koha/admin/biblio_framework.pl?op=add_form
2. Add a text in the field Description that contains js
3. Save the page.
4. Notice js is execute
5. Click on Actions -> MARC structure
6. Apply patch and reload, the js is escaped

Fixed for both the pages biblio_framework.pl and marctagstructure.pl

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 21 Marcel de Rooy 2017-08-25 06:25:59 UTC
Created attachment 66448 [details] [review]
Bug 19108 - Follow-up - fieldmapping.tt and items_search_fields.tt

To test:
- Add a framework with script in the description
- Access the Keywords to MARC mapping page
- Add an item search field where both name and label are script
- Try to edit/delete the added mapping

With the patch no script should be executed and everything
should still work ok.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 22 Jonathan Druart 2017-09-12 14:03:50 UTC
We are just fixing admin scripts, not very useful.
Comment 23 Jonathan Druart 2017-09-12 14:06:59 UTC
Created attachment 67085 [details] [review]
Bug 19108: (follow-up) Stored XSS in biblio_framework.pl

Prevent software error
Template process failed: undef error - text: filter not found at
/home/vagrant/kohaclone/C4/Templates.pm line 121.
Comment 24 Katrin Fischer 2017-09-19 21:14:56 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.
Comment 25 Fridolin SOMERS 2017-09-22 15:05:40 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 26 Jonathan Druart 2017-09-29 15:46:45 UTC
Pushed to master for 17.11, thanks to everybody involved!