Created attachment 186256 [details] Reflected XSS within oldrefer paramater Hi team, A reflected XSS vulnerability was discovered within the oldrefer parameter of set-library.pl within the admin portal of Koha. If an authenticated user follows the below URL, arbitrary JavaScript can be executed: http://test-intra.kohapoc/cgi-bin/koha/circ/set-library.pl?oldreferer="><script>alert('xss')</script> It appears to be due to unsanitised input reflected in both line 98 and 101 of set-library.tt: <a class="cancel" id="cancel_set_library" href="[% referer or '/cgi-bin/koha/mainpage.pl' %]">Cancel</a> <input type="hidden" name="oldreferer" value="[% referer or "/cgi-bin/koha/mainpage.pl" %]" /> I have attached a POC screenshot.
Created attachment 186260 [details] [review] Bug 40766: Prevent XSS on set-library
Created attachment 186306 [details] [review] Bug 40766: Prevent XSS on set-library Signed-off-by: David Cook <dcook@prosentient.com.au>
I believe the fix proposed is sufficient. Thanks.
Looking here
Created attachment 186599 [details] [review] Bug 40766: Prevent XSS on set-library Signed-off-by: David Cook <dcook@prosentient.com.au> Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Created attachment 186600 [details] [review] Bug 40766: (QA follow-up) Operator precedence, quoting Adding parentheses since I was not sure about precedence here. The filter should be applied to the whole expression. Adjusted double to single quotes in the second change. Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Pushed to 24.11.x-security for 24.11.09
Pushed to 22.11.x for 22.11.31
Created attachment 186925 [details] [review] Bug 40766: [24.05.x] Prevent XSS on set-library