Re: CVE affected for PHP 5.3.9 ?

[Kurt Seifried <kseifried () redhat com>]

On 01/13/2012 11:08 AM, Nicolas Grégoire wrote:
> Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit :
> > I'm not clear on how this crosses a security boundary
> Some applications *will* process untrusted XSLT stylesheets.
>
> The most basic example is online XSLT gateways :
> http://www.shell-tools.net/index.php?op=xslt
> http://online-toolz.com/tools/xslt-transformation.php
>
> You may find more with Google and a dork like [inurl:php
> inurl:"xsl=http"]. This is often used to adapt the layout of a page to
> the browser (desktop vs. mobile).
>
> There's too some more complex cases where untrusted XSLT may be used,
> like parsing SVG images, XML-DSig signatures or SAML tokens, ...
>
> Regards,
> Nicolas
Ok I'm still not clear on what the security claim is. Are you saying you
can cause arbitrary text output via XSL/XML mangling tricks? And
combined with having a script that uses something like "<sax:output
href="0wn3d.php" method="text">" you can put arbitrary text content into
this file which could then result in the file being parsed? The problem
is you'd have to write a script that does this, writes to a local file
with a file ending in .php or .shtml or whatever, in which case it's
pretty clear the script writer MEANT to do that. Again I'm still not
clear on what/how a security boundary is being crossed. How does this
elevate privileges or give you remote access that you wouldn't already
if you can upload arbitrary PHP scripts?

-- 

-- Kurt Seifried / Red Hat Security Response Team