[Bug 5131] New: XSS vulnerability in the OPAC search results interface
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Summary: XSS vulnerability in the OPAC search results interface Change sponsored?: --- Product: Koha Version: HEAD Platform: All OS/Version: All Status: NEW Severity: critical Priority: P5 Component: OPAC AssignedTo: oleonard@myacpl.org ReportedBy: robin@catalyst.net.nz QAContact: koha-bugs@lists.koha-community.org Estimated Hours: 0.0 In opac-search.pl: foreach my $sort (@sort_by) { $template->param($sort => 1); # FIXME: security hole. can set any TMPL_VAR here } This makes it pretty easy for someone to do things like inject arbitrary HTML and Javascript, and so steal the credentials of another user. This operation needs a whitelist of valid values that it checks against. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Robin Sheat <robin@catalyst.net.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|critical |major --- Comment #1 from Robin Sheat <robin@catalyst.net.nz> 2010-08-13 00:04:39 UTC --- Oh, it's not all that bad after all - you can't inject arbitrary code, but you can still overwrite any TMPL_VAR. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Frère Sébastien Marie <semarie-koha@latrappe.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |semarie-koha@latrappe.fr --- Comment #2 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2011-07-26 09:06:35 UTC --- As this kind of code permit user to control some System Preferences setted normally by admin, it should be corrected. One example: activation of Amazon images (on 3.4.2, using "sort_by=OPACAmazonEnabled&sort_by=OPACAmazonCoverImages") If it don't permit injection of code (it only add a template parameter of the chosen name and with value = "1"), it could permit to control of workflow for inclusion of unwanted part of code. So it is a possible vector for potentials issues. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 --- Comment #3 from Frère Sébastien Marie <semarie-koha@latrappe.fr> 2011-07-27 11:19:39 UTC --- Created attachment 4753 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4753 proposed patch I take the list of possible values for $sort_by parameter in 'koha-tmpl/opac-tmpl/prog/en/includes/resort_form.inc' (the select/options used for display "sort by" select), build a list with, and check the $sport_by value against. So only values from this list are allowed to be setted. -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 |PATCH-Sent CC| |chris@bigballofwax.co.nz Patch Status|--- |Needs Signoff -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4753|0 |1 is obsolete| | --- Comment #4 from Chris Cormack <chris@bigballofwax.co.nz> 2011-07-27 21:16:41 UTC --- Created attachment 4759 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4759 Bug 5131 :restrict use of sort_by value to allowed values The user input for sort_by value was used without care, resulting the possibility for user to set any Template Variable to 1. This patch restrict the values to sort field. The list of allowd_sortby was taken from 'includes/resort_form.inc'. Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz> -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Needs Signoff |Signed Off -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #4759|0 |1 is obsolete| | --- Comment #5 from Paul Poulain <paul.poulain@biblibre.com> 2011-08-03 13:32:06 UTC --- Created attachment 4821 --> http://bugs.koha-community.org/bugzilla3/attachment.cgi?id=4821 proposed patch (passed QA) QA comment Will mark as "passed QA" but I have a few comments though: * it's more perlish to write $x= value if $cond; rather than if ($cond) { $x=value; } * The list is hardcoded, so if one day a new sorting is added, we will have to add the sorting here as well (but there's no other option, I agree) -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Paul Poulain <paul.poulain@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |paul.poulain@biblibre.com Patch Status|Signed Off |Passed QA -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=5131 Chris Cormack <chris@bigballofwax.co.nz> changed: What |Removed |Added ---------------------------------------------------------------------------- Patch Status|Passed QA |Patch Pushed --- Comment #6 from Chris Cormack <chris@bigballofwax.co.nz> 2011-08-04 01:19:25 UTC --- Pushed, please test -- Configure bugmail: http://bugs.koha-community.org/bugzilla3/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA Contact for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org