[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4F21E662.8060308@redhat.com>
Date: Thu, 26 Jan 2012 16:48:50 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Nicolas Grégoire <nicolas.gregoire@...rri.fr>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: XSLT issue in MoinMoin
On 01/24/2012 02:37 PM, Nicolas Grégoire wrote:
>
>> How exactly does the attacker get access to the filesystem using XSLT?
>
> An attacker can read files using either the doc-as-string() extension
> function or a XML External Entity attack. Write access is done via the
> <exsl:document> extension element.
>
> Depending of your policy, you may want to affect one, two or three CVE
> (one by vector ? by impact ? by type of bug ?).
>
>> Does everything using 4Suite have this issue?
>
> Yes. Unless an obscure and undocumented option allows to deactivate this
> behavior :-(
>
> My XSLT Wiki has some additional details, including PoC code :
> - http://goo.gl/3A7h2 (4Suite)
> - http://goo.gl/GI5NK (MoinMoin)
>
> Regards,
> Nicolas
>
I think this issue warrants some more discussion, is the vuln in
moinmoin (and by extension anyone using 4Suite in a similar manner), or
is it a 4Suite issue (and in this case it's intended behaviour and not a
security issue?). Steve: care to weigh in?
--
Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
