CVE-2018-25101

Executive Summary

CVE-2018-25101 is a stored cross-site scripting (XSS) vulnerability in the Koha open-source library management system, affecting versions up to and including the 20180108 release. The flaw resides in the /cgi-bin/koha/opac-MARCdetail.pl script, where the biblionumber parameter is not properly sanitized before being reflected in the response. An attacker can inject arbitrary HTML or JavaScript by crafting a malicious URL, leading to potential session hijacking, defacement, or data theft. The vulnerability has a low CVSS score of 3.5 due to the requirement for user interaction and the limited impact on confidentiality. A patch is available via commit 950fc8e101886821879066b33e389a47fb0a9782, and upgrading to a patched version is strongly recommended.

Supply Chain & Package Security

This vulnerability affects the Koha open-source project, which is distributed as a Perl-based application. While not a package manager dependency issue, organizations using Koha should verify their deployment version and apply the patch from the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: Required (UI:R) – The victim must click a crafted link or visit a malicious page.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: None (C:N) – No direct data exposure.
• Integrity Impact: Low (I:L) – An attacker can modify content within the victim's browser session.
• Availability Impact: None (A:N) – No denial-of-service effect.

Threat Level: Low. The requirement for user interaction significantly reduces the likelihood of automated exploitation. However, in a library context, a crafted link could be distributed via email or social engineering to target staff or patrons.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the Koha OPAC (Online Public Access Catalog) module. The file opac-MARCdetail.pl is responsible for displaying MARC (Machine-Readable Cataloging) record details. It accepts a biblionumber parameter via GET or POST to identify which record to display.

The root cause is the lack of output encoding when the biblionumber value is embedded in the HTML response. An attacker can inject a payload such as:

2"><script>alert('XSS')</script>

When the server processes this request, it reflects the unescaped input directly into the page source, causing the browser to execute the injected script. The attack is stored only in the sense that the malicious URL can be bookmarked or shared, but the payload is not persisted in the database.

The patch (commit 950fc8e101886821879066b33e389a47fb0a9782) introduces proper HTML entity encoding for the biblionumber parameter before output, neutralizing any injected HTML or JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (pre-patch):

# In opac-MARCdetail.pl
my $biblionumber = $cgi->param('biblionumber');
# ... later in the HTML output
print "<a href=\"/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=$biblionumber\">$biblionumber</a>";

Patched Code (post-patch):

# In opac-MARCdetail.pl
use HTML::Entities;
my $biblionumber = $cgi->param('biblionumber');
my $encoded_biblionumber = encode_entities($biblionumber);
# ... later in the HTML output
print "<a href=\"/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=$encoded_biblionumber\">$encoded_biblionumber</a>";

The patch uses the HTML::Entities module to encode special characters like <, >, ", and & into their HTML entity equivalents, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Koha instance (version <= 20180108) accessible over the network.
• A victim user who will click a crafted link.

Exploitation Steps:

1. Craft a malicious URL:

   http://target/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2%22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E
   

   (URL-encoded payload: 2"><script>alert('XSS')</script>)
2. Send the link to a victim via email, chat, or embed it in a webpage.
3. When the victim clicks the link, the script executes in their browser context.

Advanced Payload Example:

http://target/cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2%22%3E%3Cimg%20src=x%20onerror=alert(document.cookie)%3E

This payload steals the victim's cookies.

Blue Team

Detection:

• Monitor web server logs for requests to /cgi-bin/koha/opac-MARCdetail.pl containing suspicious biblionumber parameters (e.g., <script>, onerror=, javascript:).
• Use a Web Application Firewall (WAF) to block requests with HTML/JavaScript in the biblionumber parameter.

Mitigation:

• Apply the patch immediately by updating Koha to a version that includes commit 950fc8e101886821879066b33e389a47fb0a9782.
• If patching is not possible, implement a reverse proxy rule to sanitize the biblionumber parameter:

  location /cgi-bin/koha/opac-MARCdetail.pl {
      if ($arg_biblionumber ~* "<|>|script|onerror") {
          return 403;
      }
  }
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /cgi-bin/koha/opac-MARCdetail.pl with biblionumber containing HTML tags or JavaScript event handlers.
  • Example: GET /cgi-bin/koha/opac-MARCdetail.pl?biblionumber=2%22%3E%3Cscript%3Ealert(1)%3C/script%3E
• File IOCs:
  • Unpatched file: opac-MARCdetail.pl (check for absence of HTML::Entities usage).
• Log IOCs:
  • Web server access logs showing unusual biblionumber values.

Detection Engineering

YARA Rule

rule CVE_2018_25101_Koha_XSS {
    meta:
        description = "Detects exploitation attempts of CVE-2018-25101 in Koha opac-MARCdetail.pl"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2018-25101"
    strings:
        $xss_payload = /biblionumber=[^&]*<[^>]*script/i
        $xss_event = /biblionumber=[^&]*on\w+\s*=/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2018-25101 Koha opac-MARCdetail.pl XSS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting Koha opac-MARCdetail.pl with suspicious biblionumber parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cgi-bin/koha/opac-MARCdetail.pl'
        cs-uri-query|re: 'biblionumber=.*<.*script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in biblionumber (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2018-25101 Koha opac-MARCdetail.pl XSS Attempt"; flow:to_server,established; content:"/cgi-bin/koha/opac-MARCdetail.pl"; http_uri; pcre:"/biblionumber=[^&]*<[^>]*script/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Koha to a version that includes commit 950fc8e101886821879066b33e389a47fb0a9782. This is the only complete fix.
2. Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing <script> or onerror in the biblionumber parameter.
3. Input Validation: Implement server-side validation to reject any biblionumber that contains non-numeric characters (since biblionumbers are typically integers).
4. Output Encoding: Ensure all user-supplied data is HTML-entity encoded before being rendered in the response.
5. User Awareness: Educate staff and patrons about the risks of clicking suspicious links, especially those containing the Koha OPAC URL.

Valters IT
Securing Digital Infrastructure