Bug 20083 - Information disclosure when (mis)using the MARC Preview feature
Summary: Information disclosure when (mis)using the MARC Preview feature
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: unspecified
Hardware: All All
: P3 normal (vote)
Assignee: Andreas Roussos
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on: 8872
Blocks:
  Show dependency treegraph
 
Reported: 2018-01-24 07:12 UTC by Andreas Roussos
Modified: 2018-04-04 19:12 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
patch that fixes showmarc.pl (1.19 KB, patch)
2018-01-24 07:12 UTC, Andreas Roussos
Details | Diff | Splinter Review
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature (2.63 KB, patch)
2018-01-26 01:14 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature (2.54 KB, patch)
2018-01-26 01:28 UTC, M. Tompsett
Details | Diff | Splinter Review
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature (2.59 KB, patch)
2018-01-26 02:14 UTC, M. Tompsett
Details | Diff | Splinter Review
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature (2.68 KB, patch)
2018-01-26 06:44 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 20083: Follow up - use same logic in opac-showmarc (2.22 KB, patch)
2018-01-30 22:47 UTC, M. Tompsett
Details | Diff | Splinter Review
Bug 20083: Follow up - use same logic in opac-showmarc (2.32 KB, patch)
2018-01-31 12:17 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Roussos 2018-01-24 07:12:24 UTC
Created attachment 70872 [details] [review]
patch that fixes showmarc.pl

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

I have fixed this locally by moving the call to get_template_and_user()
outside the if-else block at the bottom of showmarc.pl. See the attached
patch for more details.

I'm setting the severity to 'Normal' and the priority to 'P3' for the time
being, feel free to change them if you disagree.
Comment 1 Liz Rea 2018-01-26 01:14:36 UTC
Created attachment 70923 [details] [review]
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

- note that I (Liz) am only putting this patch in a testable form, patch/changes written by Andreas Roussos
Comment 2 M. Tompsett 2018-01-26 01:26:17 UTC
Comment on attachment 70872 [details] [review]
patch that fixes showmarc.pl

Not a useable patch. Liz Rea provided one.
Comment 3 M. Tompsett 2018-01-26 01:28:41 UTC
Created attachment 70924 [details] [review]
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.
Comment 4 M. Tompsett 2018-01-26 01:29:41 UTC
Made sure the author was set correctly in the patch. Have not tested it. Set the bug to arouss1980@gmail.com as he provided the patch.
Comment 5 M. Tompsett 2018-01-26 02:14:42 UTC
Created attachment 70929 [details] [review]
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>
Comment 6 Marcel de Rooy 2018-01-26 06:44:53 UTC
Created attachment 70931 [details] [review]
Bug 20083 - Information disclosure when (mis)using the MARC Preview feature

The MARC Preview feature in the Staff client (catalogue/showmarc.pl) does not
check whether a user is logged in or not. As a consequence, it can be used to
obtain information that would normally be available to logged-in users only.
For example, you can view any bibliographic record by passing a value to the
'id' argument, but you can also view records as they were imported (normally
done via the 'Staged MARC management' tool).

All three 17.11 installations currently listed at
https://wiki.koha-community.org/wiki/Koha_Demo_Installations
are affected by this issue, as demonstrated by the URLs below:

http://koha.adminkuhn.ch:8080/cgi-bin/koha/catalogue/showmarc.pl?importid=1&viewas=html
http://pro.demo1711-koha.test.biblibre.eu/cgi-bin/koha/catalogue/showmarc.pl?id=1000&viewas=html
https://staff-kohademo.equinoxinitiative.org/cgi-bin/koha/catalogue/showmarc.pl?id=1&viewas=html

It should be noted that this only applies to XSLT-enabled installations.

Signed-off-by: Mark Tompsett <mtompset@hotmail.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Jonathan Druart 2018-01-30 17:46:30 UTC
Sure it's not the expected behaviour? How bad is that?

Same fix must be provided for opac-showmarc.pl.
Comment 8 M. Tompsett 2018-01-30 22:47:09 UTC
Created attachment 71077 [details] [review]
Bug 20083: Follow up - use same logic in opac-showmarc

It was correctly pointed out that opac-showmarc would leak
the same way as catalogue/showmarc.pl, and so this patch
moves the authentication step up to the top where it
should be so as to prevent inappropriate data leaks.

TEST PLAN
---------
1) Set your OpacPublic system preference to Disabled
2) Open your OPAC and login
3) Find a biblio with items
4) Go to the opac details, particularly MARC view.
5) Copy the "view plain" shortcut link.
6) log out.
7) Paste the link into the address bar.
   -- the information will leak!
8) apply the patch
9) restart_all
10) Refresh the OPAC link
    -- log in screen will appear.
11) run koha qa test tools
Comment 9 M. Tompsett 2018-01-30 22:50:22 UTC
The opac-showmarc leaks far more, but both leaks are bad.

You don't want people knowing that a borrower number is valid. It may be able to construct a cardnumber from it and then with study of that person social engineer or guess the password. This is particularly bad if it is an admin user.

Additionally, you don't want people necessarily knowing what is in your collection, without them not being able to log in.

If it is the expected behaviour, it is poor security as it does leak data. I believe these are for the best.
Comment 10 Marcel de Rooy 2018-01-31 12:15:47 UTC
(In reply to M. Tompsett from comment #9)
> You don't want people knowing that a borrower number is valid. It may be
> able to construct a cardnumber from it and then with study of that person
> social engineer or guess the password. This is particularly bad if it is an
> admin user.
showmarc is not about borrowers ?!

> Additionally, you don't want people necessarily knowing what is in your
> collection, without them not being able to log in.
Depends. Most libraries have an OPAC for that. But your patch depending on OpacPublic is fine with me.
Comment 11 Marcel de Rooy 2018-01-31 12:17:44 UTC
Created attachment 71084 [details] [review]
Bug 20083: Follow up - use same logic in opac-showmarc

It was correctly pointed out that opac-showmarc would leak
the same way as catalogue/showmarc.pl, and so this patch
moves the authentication step up to the top where it
should be so as to prevent inappropriate data leaks.

TEST PLAN
---------
1) Set your OpacPublic system preference to Disabled
2) Open your OPAC and login
3) Find a biblio with items
4) Go to the opac details, particularly MARC view.
5) Copy the "view plain" shortcut link.
6) log out.
7) Paste the link into the address bar.
   -- the information will leak!
8) apply the patch
9) restart_all
10) Refresh the OPAC link
    -- log in screen will appear.
11) run koha qa test tools

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 12 Jonathan Druart 2018-04-04 19:10:53 UTC
Pushed to master for 18.05
Comment 13 Jonathan Druart 2018-04-04 19:12:13 UTC
Has been backported into 17.11.04 and 17.05.10