oss-sec mailing list archives
Re: CVE affected for PHP 5.3.9 ?
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 13 Jan 2012 13:50:59 -0700
On 01/13/2012 11:08 AM, Nicolas Grégoire wrote:
Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit :I'm not clear on how this crosses a security boundarySome applications *will* process untrusted XSLT stylesheets. The most basic example is online XSLT gateways : http://www.shell-tools.net/index.php?op=xslt http://online-toolz.com/tools/xslt-transformation.php You may find more with Google and a dork like [inurl:php inurl:"xsl=http"]. This is often used to adapt the layout of a page to the browser (desktop vs. mobile). There's too some more complex cases where untrusted XSLT may be used, like parsing SVG images, XML-DSig signatures or SAML tokens, ... Regards, Nicolas
Ok I'm still not clear on what the security claim is. Are you saying you can cause arbitrary text output via XSL/XML mangling tricks? And combined with having a script that uses something like "<sax:output href="0wn3d.php" method="text">" you can put arbitrary text content into this file which could then result in the file being parsed? The problem is you'd have to write a script that does this, writes to a local file with a file ending in .php or .shtml or whatever, in which case it's pretty clear the script writer MEANT to do that. Again I'm still not clear on what/how a security boundary is being crossed. How does this elevate privileges or give you remote access that you wouldn't already if you can upload arbitrary PHP scripts? -- -- Kurt Seifried / Red Hat Security Response Team
Current thread:
- CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Ignacio Espinosa (Jan 14)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 14)
- Re: CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 14)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 14)
- Re: CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 15)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 17)
- Re: CVE affected for PHP 5.3.9 ? Nicolas Grégoire (Jan 13)
- Re: CVE affected for PHP 5.3.9 ? Kurt Seifried (Jan 13)