Our Information Security scanners have detected that opac-shelves.pl is vulnerable to Cross-site scripting attacks. We are currently on version 17.11. GET: https://catalog.uttyler.edu/cgi-bin/koha/opac-shelves.pl?op=list&category=2%22%3E%3Cscript%3Ealert(150)%3C/script%3E
This was partially fixed in bug 19333 This error is coming from the paging (only can recreate when you have a list big enough to have multiple pages of results)
Any ETA on this bug? Our security scanner keeps flagging the vulnerability.
Created attachment 121209 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl
*** Bug 28398 has been marked as a duplicate of this bug. ***
Created attachment 121258 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Apply the patch & restart services 4. Repeat the above and you are not redirected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
It seems to work :D By testing with only the client and the server part, we can see that each of them is enough to fix. And more importantly that the server part is enough. So a compromised client can't bypass the fix. Thanks David for the test plan. Is that enough to test the vulnerability? I couldn't exploit with the example in this ticket.
Yeah looks good to me, Victor. I'll QA it shortly.
So there are other places where the category should be validated. However, I think we've done enough for this particular bug. I think that other validation is out of scope.
Created attachment 121264 [details] [review] Bug 20982: Sanitize category to prevent XSS on opac-shelves.pl == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Apply the patch & restart services 4. Repeat the above and you are not redirected Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net> Signed-off-by: David Cook <dcook@prosentient.com.au>
*** Bug 28409 has been marked as a duplicate of this bug. ***
Actually, it makes sense to validate it more comprehensively here...
Created attachment 121266 [details] [review] Bug 20982: Comprehensively validate category in opac-shelves.pl Default to a category of 1 (ie Private). Only allow input of 1 or 2 (ie Public) == Test plan == 1. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 2. Note that you are redirected to another website 3. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=foo&category=9 4. Note that you can't see this list in the Lists (but it has been added to the database) 5. Apply the patch & restart services 6. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?category=function(){window.location.href%20=%20%27https://git.koha-community.org/stats/koha-master/authors.html%27}() 7. Note that you are not redirected to another website 8. Go to http://localhost:8080/cgi-bin/koha/opac-shelves.pl?op=add&shelfname=bar&category=9 9. Note that "bar" has been added as a Private list
Thanks for the follow-up, David. I am reopening bug 28409 and moving your patch there. I have another follow-up and maybe more work is needed so I don't think it should be done here.
So, passed QA for this one?
Current version applies and work on 19.11.x
(In reply to Victor Grousset/tuxayo from comment #14) > So, passed QA for this one? Yep!
> Yep! Ok, so backported in my local secret 19.11.x branch ^^
Pushed to master for 21.05, thanks to everybody involved!