Insufficient parameter validation allows unauthenticated exfiltration of AT output

[Jason Boyer]

When printing lists (or the basket, which is the temporary list) you're routed through /eg/opac/record/print_preview/<hash>?blahblah, and if you click the Print Now button you are sent to /eg/opac/record/print/<ate_id> and then you get your printout.

I wonder what happens if you change that number.

Spoiler alert: check out the sweet password reset email printout in the attached image.

So it's possible to retrieve the output of any / every AT event in the system by simply starting at 1 and incrementing until you get bored of it. Additionally, while you have to be logged in to request a print preview, you do /not/ have to be logged in to print the output, so anyone can do this to any system without logging in.

Branch coming soon that verifies that the event in question has the appropriate hook for the requested action.

[Jason Boyer (jboyer)]

Here's the branch that addresses it; in collab since Mike actually wrote it, not that I necessarily anticipate any additions.

security/collab/jboyer/lp2070078_plug_print_leak

[Jane Sandberg (sandbergja)]

Thanks, Jason and Mike! This is a very good catch. I was able to confirm this on enhanced concerto:
1. Enable the password reset action trigger
2. Adding an email address to a patron in the staff client
3. Requesting a password reset for them in the OPAC
4. As opensrf: action_trigger_runner.pl --run-pending
5. As an unauthenticated user, creating a basket in the OPAC and printing it
6. Closing the print dialog and changing the ID in the URL
7. Using the provided password reset URL to change the patron's password

The patch didn't work for me out of the box, I got Internal Server errors even when trying to view bib list output, and perl -c said:

Global symbol "$self" requires explicit package name (did you forget to declare "my $self"?) at /home/opensrf/repos/Evergreen/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader/Record.pm line 729.
/home/opensrf/repos/Evergreen/Open-ILS/src/perlmods/lib/OpenILS/WWW/EGCatLoader/Record.pm had compilation errors.

I pushed my signoff, along with a lil follow up commit to make it compile to security/collab/sandbergja/lp2070078_plug_print_leak. I also took the opportunity to add the LP number and a release note to the original commit. Definitely feel free to amend if my follow-up is not what you had in mind, or if the release note is not to your liking.

Have a good weekend!

[Galen Charlton (gmc)]

I've reviewed and verified the latest branch. My signoff is now sitting in security/user/gmcharlt/lp2070078_plug_print_leak and will be incorporated into the overall branches I'm preparing for the June 2024 security release.