Anyone with the "catalogue" permission (ie anyone with staff interface permission) can run any Perl file on the file system by using a maliciously crafted URL.
Created attachment 167944 [details] [review] Bug 37146: Prevent path traversal by validating input This patch validates the plugin_name passed to plugin_launcher.pl against the base path containing the "value_builder" directory. Test plan: 0. Apply the patch 1. koha-plack --reload kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29 3. Check that the tag editor for leader still works 4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29 5. Check that the pluginf or "Date acquired" still works
Just noticed the unit test which I couldn't find before... t/db_dependent/FrameworkPlugin.t That's still passing which is good -- I feel like I've heard of people providing their own framework plugins but hopefully they've been putting them in the right place and not relying on insecure relative paths...
(In reply to David Cook from comment #3) > I feel like I've heard of people providing their own framework plugins but > hopefully they've been putting them in the right place and not relying on > insecure relative paths... That said, if they've symlinked in their plugins from somewhere else, those won't work anymore... I suppose an alternative to Cwd::abs_path() would be to use File::Basename to just get the actual filename and not any of the path. -- I'm not too fussed either way. Basically, we just need to validate that the user input refers to a file that's actually in the value_builder directory.
Created attachment 167957 [details] [review] Bug 37146: Prevent path traversal by validating input This patch validates the plugin_name passed to plugin_launcher.pl against the base path containing the "value_builder" directory. Test plan: 0. Apply the patch 1. koha-plack --reload kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29 3. Check that the tag editor for leader still works 4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29 5. Check that the pluginf or "Date acquired" still works Signed-off-by: Nick Clemens <nick@bywatersolutions.com>
Just adding, the permissions here might need to be addressed - the launcher requires only 'catalogue' - the plugins themselves vary between: catalogue => 1 editcatalogue => * I do know that we have partners using cn_browser directly as a way to find items - s don't want to break that, however, raising above catalogue makes sense
Created attachment 168301 [details] [review] Bug 37146: Prevent path traversal by validating input This patch validates the plugin_name passed to plugin_launcher.pl against the base path containing the "value_builder" directory. Test plan: 0. Apply the patch 1. koha-plack --reload kohadev 2. Go to http://localhost:8081/cgi-bin/koha/cataloguing/addbiblio.pl?biblionumber=29 3. Check that the tag editor for leader still works 4. Go to http://localhost:8081/cgi-bin/koha/cataloguing/additem.pl?biblionumber=29 5. Check that the pluginf or "Date acquired" still works Signed-off-by: Nick Clemens <nick@bywatersolutions.com> Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Created attachment 168781 [details] [review] Bug 37146: Add tests
This has been backported to 24.05.x-security branch for 24.05.02
Pushed for 24.11! Well done everyone, thank you!