Bug 23058 - Cross-site scripting in OPAC search
Summary: Cross-site scripting in OPAC search
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-06-05 19:44 UTC by systems_analysts
Modified: 2020-11-30 21:45 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
19.11.00, 19.05.01, 18.11.07, 18.05.14


Attachments
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (899 bytes, patch)
2019-06-05 23:43 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (955 bytes, patch)
2019-06-06 12:16 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search (1013 bytes, patch)
2019-06-09 20:30 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Jonathan Druart 2019-06-05 23:42:15 UTC
Confirmed, good catch.

Hiding the URL from the description:

GET: https://catalog.kohadev.local/cgi-bin/koha/opac-search.pl?tag=ft%22%3E<script>alert(150)</script>&q=ft

ATTACK DETAILS:
This page is vulnerable to Cross-site scripting attacks.

Cross-site scripting attacks, in general, are an issue because
they are enabling attacks. Specially-crafted malicious URLs can
steal authentication tokens/cookies when a logged-in user visits them,
giving the attacker full access to that user's account in the application.
Reflected XSS attacks, in particular, are a concern as they can be used to
socially engineer a user into clicking on what appears to be a legitimate URL.
Comment 2 Jonathan Druart 2019-06-05 23:43:54 UTC
Created attachment 90342 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search
Comment 3 Nick Clemens 2019-06-06 12:16:43 UTC
Created attachment 90358 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 4 Katrin Fischer 2019-06-09 20:30:07 UTC
Created attachment 90447 [details] [review]
Bug 23058: Prevent XSS vulnerabiliies when 'tag' is passed to opac-search

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Martin Renvoize 2019-07-02 07:56:47 UTC
Nice work!

Pushed to master for 19.11.00
Comment 6 Martin Renvoize 2019-07-02 08:10:21 UTC
Also pushed, and released, to stable, oldstable and oldoldstable
Comment 7 Liz Rea 2019-07-02 16:23:46 UTC
pushed to 18.05 for 18.05.14