]> git.koha-community.org Git - koha.git/commit
Bug 14408 Path traversal vulnerability
authorJonathan Druart <jonathan.druart@koha-community.org>
Fri, 19 Jun 2015 08:12:45 +0000 (10:12 +0200)
committerMason James <mtj@kohaaloha.com>
Sun, 21 Jun 2015 17:43:54 +0000 (05:43 +1200)
commit0b7647eff31c85d8f7e1e5a50fd82d3b94eec816
treec0775cf9d52b7d7ff71726c181ac3bb8b5aecff3
parent1383f2798206ab323513221d0930949a63e18c25
Bug 14408 Path traversal vulnerability

/cgi-bin/koha/svc/virtualshelves/search
/cgi-bin/koha/svc/members/search

Are vulnerable

To test:
1/ Hit /cgi-bin/koha/svc/members/search?template_path=members/tables/members_results.tt
  Notice you get a valid JSON response
2/ Hit
/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
  (You may have add more ..%2f or remove them to get the correct path)
  Notice you can see the contents of the /etc/passwd file
3/ Hit
/cgi-bin/koha/svc/members/search?template_path=test%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
4/ Apply patch
5/ Hit the first url again, notice it still works
6/ Hit the second url notice it now errors with a file not found
7/ Hit the third url notice it now errors with a file not found

Repeat for the other script also

Signed-off-by: Katrin Fischer <katrin.fischer@bsz-bw.de>
Signed-off-by: Kyle M Hall <kyle@bywatersolutions.com>
Signed-off-by: Mason James <mtj@kohaaloha.com>
C4/Auth.pm