Bug 40766 - Reflected XSS in set-library.pl
Summary: Reflected XSS in set-library.pl
Status: Needs documenting
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Jonathan Druart
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-09-08 09:30 UTC by oos3c
Modified: 2025-10-08 08:34 UTC (History)
15 users (show)

See Also:
GIT URL:
Initiative type: ---
Sponsorship status: ---
Comma delimited list of Sponsors:
Crowdfunding goal: 0
Patch complexity: Trivial patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
25.11.00,25.05.04,24.11.09,24.05.12,22.11.31
Circulation function:


Attachments
Reflected XSS within oldrefer paramater (115.92 KB, image/png)
2025-09-08 09:30 UTC, oos3c
Details
Bug 40766: Prevent XSS on set-library (1.35 KB, patch)
2025-09-08 14:06 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 40766: Prevent XSS on set-library (1.40 KB, patch)
2025-09-10 03:35 UTC, David Cook
Details | Diff | Splinter Review
Bug 40766: Prevent XSS on set-library (1.50 KB, patch)
2025-09-19 06:33 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 40766: (QA follow-up) Operator precedence, quoting (1.63 KB, patch)
2025-09-19 06:33 UTC, Marcel de Rooy
Details | Diff | Splinter Review
Bug 40766: [24.05.x] Prevent XSS on set-library (1.53 KB, patch)
2025-09-25 16:42 UTC, Lucas Gass (lukeg)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description oos3c 2025-09-08 09:30:30 UTC
Created attachment 186256 [details]
Reflected XSS within oldrefer paramater

Hi team,

A reflected XSS vulnerability was discovered within the oldrefer parameter of set-library.pl within the admin portal of Koha.

If an authenticated user follows the below URL, arbitrary JavaScript can be executed:

http://test-intra.kohapoc/cgi-bin/koha/circ/set-library.pl?oldreferer="><script>alert('xss')</script>

It appears to be due to unsanitised input reflected in both line 98 and 101 of set-library.tt:

<a class="cancel" id="cancel_set_library" href="[% referer or '/cgi-bin/koha/mainpage.pl' %]">Cancel</a>

<input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/mainpage.pl" %]" />

I have attached a POC screenshot.
Comment 1 Jonathan Druart 2025-09-08 14:06:20 UTC
Created attachment 186260 [details] [review]
Bug 40766: Prevent XSS on set-library
Comment 2 David Cook 2025-09-10 03:35:08 UTC
Created attachment 186306 [details] [review]
Bug 40766: Prevent XSS on set-library

Signed-off-by: David Cook <dcook@prosentient.com.au>
Comment 3 oos3c 2025-09-17 12:22:42 UTC
I believe the fix proposed is sufficient. Thanks.
Comment 4 Marcel de Rooy 2025-09-19 06:21:37 UTC
Looking here
Comment 5 Marcel de Rooy 2025-09-19 06:33:40 UTC
Created attachment 186599 [details] [review]
Bug 40766: Prevent XSS on set-library

Signed-off-by: David Cook <dcook@prosentient.com.au>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Marcel de Rooy 2025-09-19 06:33:43 UTC
Created attachment 186600 [details] [review]
Bug 40766: (QA follow-up) Operator precedence, quoting

Adding parentheses since I was not sure about precedence here. The filter
should be applied to the whole expression.
Adjusted double to single quotes in the second change.

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 7 Fridolin Somers 2025-09-23 12:14:25 UTC
Pushed to 24.11.x-security for 24.11.09
Comment 8 Wainui Witika-Park 2025-09-24 07:50:45 UTC
Pushed to 22.11.x for 22.11.31
Comment 9 Lucas Gass (lukeg) 2025-09-25 16:42:15 UTC
Created attachment 186925 [details] [review]
Bug 40766: [24.05.x] Prevent XSS on set-library