Bug 19117 - paycollect.pl is vulnerable for CSRF attacks
Summary: paycollect.pl is vulnerable for CSRF attacks
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on:
Blocks: 17096
  Show dependency treegraph
 
Reported: 2017-08-15 16:26 UTC by Jiaky Ooi
Modified: 2017-11-08 08:22 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
html file for PoC (1.16 KB, text/plain)
2017-08-15 16:26 UTC, Jiaky Ooi
Details
Bug 19117: Add CSRF protection to paycollect.pl (3.60 KB, patch)
2017-10-04 20:51 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 19117: Add CSRF protection to paycollect.pl (3.65 KB, patch)
2017-10-07 13:24 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19117: Add CSRF protection to paycollect.pl (3.74 KB, patch)
2017-10-13 05:45 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jiaky Ooi 2017-08-15 16:26:20 UTC
Created attachment 66027 [details]
html file for PoC

The following issues were identified, Koha was installed on ubuntu 16.04 and mySQL with default configuration:

Vulnerability Type: Cross-site request forgery
Affected Product: koha library system
Tested Version: 17.05.02
Discovered by: Jiaky Ooi
Affected URL: 1) /cgi-bin/koha/members/paycollect.pl
Affected Parameter: borrowernumber, amount, amountoutstanding, paid


Please be aware that we will publish these vulnerability on the disclosure date when agreed.

Please reserve CVE number for this vulnerability by contacting Mitre. Further information can be found at https://cve.mitre.org/cve/request_id.html 

Please see attached for html payload used for PoC.

Many thanks

_________________________________________________________

Jiaky Ooi | Consultant

Oxford        +44 (0)1865 877 830
Dubai          +971 (0)4 427 0428  
London       +44 (0)203 5983740
New York    +1 646-781-7580

E-Mail        jiaky.ooi@dionach.com 
Web          www.dionach.com
Comment 1 Jonathan Druart 2017-08-15 17:34:15 UTC
Yes, all the forms are vulnerable for CSRF attacks, only the following scripts are fixed:

authorities/authorities-home.pl
authorities/detail.pl
basket/sendbasket.pl
members/deletemem.pl
members/member-flags.pl
members/member-password.pl
members/memberentry.pl
members/moremember.pl
opac/opac-memberentry.pl
opac/opac-sendbasket.pl
opac/sco/sco-main.pl
opac/sco/sco-patron-image.pl
tools/import_borrowers.pl
tools/picture-upload.pl
Comment 2 Jiaky Ooi 2017-08-15 20:26:07 UTC
Thanks for the prompt reply, just a verification please.

Would this mean that this will not be a 0day bug and we would require to implement custom CSRF countermeasures?
Comment 3 Jonathan Druart 2017-08-15 21:01:13 UTC
It is a known bug (at least by me).

With my answer I wanted to tell that the vulnerability is not specific to members/paycollect.pl, several other scripts are impacted.

We first fixed the forms that had a big impacts on the patron data and security (change of password, patron's detail, permissions, deletion of a patron's entry, etc.) as well as all forms of the public interface (OPAC).

It is on my todo list, but I am not considering it as high priority for now.

> Would this mean that this will not be a 0day bug and we would require to
> implement custom CSRF countermeasures?

If you implement such fixes, please share them with us :)
Comment 4 Jiaky Ooi 2017-08-16 13:23:33 UTC
(In reply to Jonathan Druart from comment #3)
> It is a known bug (at least by me).
> 
> With my answer I wanted to tell that the vulnerability is not specific to
> members/paycollect.pl, several other scripts are impacted.
> 
> We first fixed the forms that had a big impacts on the patron data and
> security (change of password, patron's detail, permissions, deletion of a
> patron's entry, etc.) as well as all forms of the public interface (OPAC).
> 
> It is on my todo list, but I am not considering it as high priority for now.
> 
> > Would this mean that this will not be a 0day bug and we would require to
> > implement custom CSRF countermeasures?
> 
> If you implement such fixes, please share them with us :)

Apologies if I caused any misunderstanding. We are not a KOHA library user. We are a pen testing company that found this vulnerability while performing a pen test for a client.

The previous question was intended to ask if the client should implement their own workaround or should they wait on a stable release from KOHA.

As this is a known issue as mentioned on your previous comment, was I the first to report this issue to KOHA? And are there any CVE numbers reserved or assigned to this issue?
Comment 5 Jonathan Druart 2017-08-22 16:10:44 UTC
(In reply to Jiaky Ooi from comment #4)
> The previous question was intended to ask if the client should implement
> their own workaround or should they wait on a stable release from KOHA.

What would be a workaround?
As I told you earlier it is on my list, but I do not know when I will have time to dedicate to this issue.

> As this is a known issue as mentioned on your previous comment, was I the
> first to report this issue to KOHA? And are there any CVE numbers reserved
> or assigned to this issue?

There are no CVE reserved.
paycollect.pl is only one of the several scripts that are vulnerable for CSRF attacks.
Comment 6 Jonathan Druart 2017-10-04 20:51:50 UTC
Created attachment 67616 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.
Comment 7 Katrin Fischer 2017-10-07 13:24:52 UTC
Created attachment 67800 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 8 Marcel de Rooy 2017-10-13 05:45:42 UTC
Created attachment 68043 [details] [review]
Bug 19117: Add CSRF protection to paycollect.pl

Security bug, trivial changes, no need to provide procedure for script
kiddies.

Test plan:
Pay fines using the different options from the "Pay fines" tab.

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 9 Jonathan Druart 2017-10-27 17:19:43 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 10 Katrin Fischer 2017-10-29 16:35:53 UTC
This patch has been pushed to 16.11.x and will be in 16.11.13.
Comment 11 Fridolin SOMERS 2017-11-08 08:22:10 UTC
These patches have been pushed to 17.05.x and are in 17.05.05.