Bug 38470 - Subscription detail page vulnerable to reflected XSS
Summary: Subscription detail page vulnerable to reflected XSS
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Serials (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-11-18 05:07 UTC by David Cook
Modified: 2025-01-17 11:47 UTC (History)
15 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.05.00,24.11.01,24.05.06,23.11.11,22.11.23
Circulation function:


Attachments
Bug 38470: Add missing double quotes to some Javascript (2.05 KB, patch)
2024-11-18 05:17 UTC, David Cook
Details | Diff | Splinter Review
Bug 38470: Add missing double quotes to some Javascript (2.11 KB, patch)
2024-12-02 17:47 UTC, Victor Grousset/tuxayo
Details | Diff | Splinter Review
Bug 38470: Add missing double quotes to some Javascript (2.17 KB, patch)
2025-01-03 10:53 UTC, Julian Maurice
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-11-18 05:07:07 UTC
I noticed the subscription detail page is vulnerable to reflected XSS in certain conditions.
Comment 2 David Cook 2024-11-18 05:17:21 UTC
Created attachment 174658 [details] [review]
Bug 38470: Add missing double quotes to some Javascript

This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.

Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>

3. Note that you're able to generate a print slip
(You may need to allow popups)

4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report
Comment 5 Victor Grousset/tuxayo 2024-12-02 17:47:33 UTC
Created attachment 175058 [details] [review]
Bug 38470: Add missing double quotes to some Javascript

This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.

Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>

3. Note that you're able to generate a print slip
(You may need to allow popups)

4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Comment 6 Victor Grousset/tuxayo 2024-12-02 17:47:51 UTC
It works! :)
Comment 10 Julian Maurice 2025-01-03 10:53:51 UTC
Created attachment 176117 [details] [review]
Bug 38470: Add missing double quotes to some Javascript

This change adds some double quotes where quotes were missing,
and replaces single quotes with double quotes, which prevents XSS.

Test plan:
0. Apply the patch
1. Create a subscription
2. Using the ID from the subscription, go to this page:
http://localhost:8081/cgi-bin/koha/serials/subscription-detail.pl?
print_routing_list_issue=1&subscriptionid=<SUBSCRIPTIONID>

3. Note that you're able to generate a print slip
(You may need to allow popups)

4. To check the security vulnerability is fixed, try the proof-of-concepts
attached to the bug report

Signed-off-by: Victor Grousset/tuxayo <victor@tuxayo.net>
Signed-off-by: Julian Maurice <julian.maurice@biblibre.com>
Comment 11 Katrin Fischer 2025-01-14 14:50:13 UTC
Pushed for 25.05!

Well done everyone, thank you!
Comment 12 Katrin Fischer 2025-01-17 11:47:51 UTC
These patches have been included in all maintained versions, see "Version(s) released in".