AI analysis
Koha, an open-source integrated library system, contains a code injection flaw (CWE-95) in a web service that listens on TCP port 8081 by default: a user-supplied string is passed to the eval function without proper validation. A remote attacker with valid authentication credentials can submit a crafted string to this service and execute arbitrary code in the context of the service account. Successful exploitation gives full compromise of confidentiality, integrity, and availability on the Koha server (CVSS 3.0: 8.8, high). Organizations running affected Koha deployments are at risk, particularly where port 8081 is reachable from untrusted networks; however, the authentication requirement limits attacks to holders of valid credentials. No public proof-of-concept or in-the-wild exploitation is known, and the issue is not on the CISA KEV list.
What to do: Apply the vendor patch specified in ZDI-26-616 (upgrade to the latest fixed Koha release). Restrict TCP 8081 at the firewall so the web service is reachable only from trusted staff/consortium networks, audit service accounts for weak or shared credentials, and review logs for unexpected code execution or anomalous activity under the service account.
Affected
| Koha Community Koha (Integrated Library System) | — |
Estimated exposure
moderate≈ thousands of library deployments globally (order of magnitude: low thousands of internet-visible Koha installations, with the 8081 service typically internal) — Koha is a self-hosted open-source ILS used by public and academic libraries worldwide, and public internet scans have historically shown on the order of a few thousand exposed Koha instances, though the vulnerable TCP 8081 service is…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165.