Bug 24673 - CSRF vulnerability in opac-messaging.pl
Summary: CSRF vulnerability in opac-messaging.pl
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: master
Hardware: All All
: P5 - low major (vote)
Assignee: David Cook
QA Contact:
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-02-17 06:32 UTC by David Cook
Modified: 2020-03-26 11:37 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:
20.05.00, 19.11.04, 19.05.09, 18.11.15,


Attachments
Bug 24673: Add CSRF token support to opac-messaging.pl (3.70 KB, patch)
2020-02-17 06:59 UTC, David Cook
Details | Diff | Splinter Review
Bug 24673: Add CSRF token support to opac-messaging.pl (3.72 KB, patch)
2020-02-26 15:49 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2020-02-17 06:32:33 UTC
Using a URL like the following, you can trick a user into updating their messaging preferences - most importantly the SMSnumber. 

http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
Comment 1 David Cook 2020-02-17 06:59:04 UTC
Created attachment 99066 [details] [review]
Bug 24673: Add CSRF token support to opac-messaging.pl

This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.

Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update

4. Apply the patch

5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly
Comment 2 Jonathan Druart 2020-02-26 15:49:17 UTC
Created attachment 99654 [details] [review]
Bug 24673: Add CSRF token support to opac-messaging.pl

This patch adds CSRF token support to opac-messaging.pl,
which allows users to manually update their messaging preferences,
but prevents bad actors from tricking people into updating their
preferences from cross-site requests.

Test plan:
0. Set SMSSendDriver global system preference to "Test" if unset
1. Log into the OPAC
2. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
3. Observe that the preference and SMS number update

4. Apply the patch

5. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl?modify=yes
&1=email&digest=1&2-DAYS=5&2=email&digest=2&4=email&SMSnumber=0444444444
6. Observe that you get an error message of "Wrong CSRF token" instead
of the previous behaviour
7. Navigate to a URL in your browser like the following:
http://localhost:8080/cgi-bin/koha/opac-messaging.pl
8. Update "Advance notice" to 3 and update "SMS number" to 61111111111
9. Observe that the "Advance notice" and "SMS number" fields update
correctly

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 3 Jonathan Druart 2020-02-26 15:50:28 UTC
Trivial, skipping QA.
Comment 4 Joy Nelson 2020-03-23 23:55:52 UTC
Pushed to 19.11.04
Comment 5 Hayley Mapley 2020-03-24 03:13:43 UTC
Backported to 18.11.x for 18.11.15
Comment 6 Lucas Gass 2020-03-24 20:53:53 UTC
backported to 19.05.x for 19.05.09
Comment 7 Martin Renvoize 2020-03-26 11:36:11 UTC
Pushed to master