Koha Security Update: Fixes for RCE, Multiple SQL Injections, and Auth Bypass

Vulnerability Overview Koha version 25.05.13 was released, containing fixes for multiple security vulnerabilities. The primary vulnerabilities include: 1. Remote Code Execution (RCE): A remote code execution vulnerability exists within user-supplied regular expressions. 2. Stored SQL Injection: A stored SQL injection exists in via an unvalidated . 3. Stored SQL Injection: A stored SQL injection exists via patron card layout image names ( -> ). 4. SQL Injection: An SQL injection exists in via the parameter (ORDER BY direction). 5. SIP Authentication Bypass: SIP authentication is ignored after an initial successful connection. 6. SQL Injection: An SQL injection exists in via the patron language value in (stored / second-order, executed during issue-slip printing, unvalidated string context, no placeholder). 7. OPAC Page Restriction Bypass: OPAC pages restricted to specific libraries can be read by unauthenticated users. Impact Scope Remote Code Execution (RCE): Affects all scenarios involving user-supplied regular expressions. Stored SQL Injection: Affects scenarios involving , patron card layouts, , and . SIP Authentication Bypass: Affects the SIP authentication process. OPAC Page Restriction Bypass: Affects OPAC pages restricted to specific libraries. Remediation 1. Remote Code Execution (RCE): Refactor regular expression handling, shifting from Perl's traditional compile-time regular expression processing to more dynamic (but constrained) run-time regular expression processing, analogous to Python's regex method, to reduce the risk of code injection into Koha's Perl backend. 2. Stored SQL Injection: Validate and sanitize inputs to prevent SQL injection. 3. SIP Authentication Bypass: Ensure SIP authentication is enforced and not ignored after an initial successful connection. 4. OPAC Page Restriction Bypass: Enforce restrictions on library-specific OPAC pages to prevent unauthorized access by unauthenticated users. Proof of Concept (PoC) Code or Exploit Code No specific PoC code or exploit code was provided.

Goal Reached Thanks to every supporter — we hit 100%!

Koha Security Update: Fixes for RCE, Multiple SQL Injections, and Auth Bypass