Bug 26904 - OPAC password recovery allows regexp in email
Summary: OPAC password recovery allows regexp in email
Status: Pushed to oldoldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Fridolin Somers
QA Contact: Testopia
URL:
Keywords:
Depends on: 20023
Blocks:
  Show dependency treegraph
 
Reported: 2020-11-03 08:18 UTC by Fridolin Somers
Modified: 2020-11-27 13:42 UTC (History)
10 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Text to go in the release notes:
Version(s) released in:
20.11.00, 20.05.06, 19.11.12, 19.05.17


Attachments
Bug 26904: OPAC password recovery allows regexp in email (1.99 KB, patch)
2020-11-03 08:32 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 26904: OPAC password recovery allows regexp in email (2.00 KB, patch)
2020-11-03 08:54 UTC, Fridolin Somers
Details | Diff | Splinter Review
Bug 26904: OPAC password recovery allows regexp in email (2.06 KB, patch)
2020-11-03 10:50 UTC, Nick Clemens
Details | Diff | Splinter Review
Bug 26904: OPAC password recovery allows regexp in email (2.12 KB, patch)
2020-11-06 10:22 UTC, Julian Maurice
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Fridolin Somers 2020-11-03 08:18:25 UTC
When using OPAC password recovery form, opac/opac-password-recovery.pl : 
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare and remove the case insensitive.
If one does only provide email address it is case sensitive.
Comment 1 Fridolin Somers 2020-11-03 08:32:04 UTC
Created attachment 112895 [details] [review]
Bug 26904: OPAC password recovery allows regexp in email

When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare and remove the case insensitive.
If one does only provide email address it is case sensitive.

Test plan :
1) Enable system preference OpacResetPassword
2) Go to OPAC > Log in to your account > Forgot your password?
3) Enter an existing userid or cardnumber and '.*' in 'Email'
4) Without patch the password recovery is send, with patch you get the
   message 'No account was found with the provided information.'
5) Enter an existing userid or cardnumber and in 'Email' the
   corresponding email but with different case
6) Without patch the password recovery is send, with patch you get the
   message 'No account was found with the provided information.'
Comment 2 Fridolin Somers 2020-11-03 08:35:51 UTC
Ah this RegExp was introduced by Bug 20023
Comment 3 Fridolin Somers 2020-11-03 08:40:54 UTC
(In reply to Fridolin SOMERS from comment #0)
> 
> I propose to use simple string compare and remove the case insensitive.
> If one does only provide email address it is case sensitive.

Oh my mistake, DB is case insensitive of actually if one does only provide email address it is case insensitive.
I change my patch
Comment 4 Fridolin Somers 2020-11-03 08:54:33 UTC
Created attachment 112898 [details] [review]
Bug 26904: OPAC password recovery allows regexp in email

When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')
Comment 5 Nick Clemens 2020-11-03 10:50:18 UTC
Created attachment 112910 [details] [review]
Bug 26904: OPAC password recovery allows regexp in email

When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Comment 6 Julian Maurice 2020-11-06 10:22:52 UTC
Created attachment 113223 [details] [review]
Bug 26904: OPAC password recovery allows regexp in email

When using OPAC password recovery form, opac/opac-password-recovery.pl :
if one provides correct login and an email, there is a check that this email is one of patron's.

This check uses RegExp with case insensitive :
  if ( $email && !( any { /^$email$/i } @emails ) )

This is a security issue since one can simply enter '.*'.
Severity is normal because the login must be a correct.

I propose to use simple string compare with lowercase to be case insensitive.

Test plan :
1) Don't apply patch
2) Enable system preference 'OpacResetPassword'
3) Go to 'OPAC > Log in to your account > Forgot your password?'
4) Enter an existing userid or cardnumber and '.*' in 'Email'
5) The password recovery is created ! (check table 'borrower_password_recovery')
6) Apply patch
7) Enter an existing userid or cardnumber and '.*' in 'Email'
8) You get the message 'No account was found with the provided information.'
9) Enter an existing userid or cardnumber and in 'Email' the corresponding email but with different case
10) The password recovery is created (check table 'borrower_password_recovery')

Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 7 Jonathan Druart 2020-11-10 14:00:57 UTC
Pushed to master for 20.11, thanks to everybody involved!
Comment 8 Jonathan Druart 2020-11-11 10:18:33 UTC
Oops, I pushed that one too early!
Comment 9 Victor Grousset/tuxayo 2020-11-11 20:17:51 UTC
IIUC it's possible to get a recovery email sent to another valid address. From the same domain or not. Which would make this more severe.

$email comes from the user
https://gitlab.com/koha-community/Koha/-/blob/cdbc04f69d751d2b08dc256d61972330512c3a0d/opac/opac-password-recovery.pl#L29

$email is left untouched IIUC and is used to send the recovery email.
https://gitlab.com/koha-community/Koha/-/blob/cdbc04f69d751d2b08dc256d61972330512c3a0d/opac/opac-password-recovery.pl#L139

== Case 1: same domain ==
Email addresses can contain * in the local part.
https://en.wikipedia.org/wiki/Email_address#Local-part

victim email:  my-non-attacker-email@example.org
attacker email: my-.*-attacker-email@example.org

The attacker's should match the victim's and trigger the recovery email that will be sent to the attacker's address.

== Case 2: different domain ==
It's even simpler

victim email:   victim-email@example.org
attacker email: victim-email@ex.mple.org
Comment 10 Victor Grousset/tuxayo 2020-11-23 14:50:55 UTC
Backported to 19.05.x branch for 19.05.17
Comment 11 Lucas Gass 2020-11-23 23:10:50 UTC
backported to 20.05.x for 20.05.06
Comment 12 Aleisha Amohia 2020-11-24 00:30:33 UTC
backported to 19.11.x for 19.11.12