CVE request: Remote code execution via XSL extensions in SpagoBI

[David Jorm <djorm () redhat com>]

Hi All

Can a CVE ID please be assigned for part 1) of this issue:

https://www.spagoworld.org/jira/browse/SPAGOBI-1885

Anyone who has permission to define a document that uses the 
accessibility engine can supply an XSL file that will be used to 
transform the data in the presentation view. SpagoBI is using Xalan to 
perform the transformation, and there's two problems:

1) FEATURE_SECURE_PROCESSING is not set. This means an attacker can 
provide an XSL document with embedded Java code, which will be executed 
on the server.

2) SpagoBI is using Xalan 2.6.0. A flaw in this version means that if 
with FEATURE_SECURE_PROCESSING set, an attacker can bypass the 
restrictions, and provide XSL documents with embedded Java code. To 
address this, you need to upgrade to >= 2.7.2:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0107

I have provided a reproducer to the developers via email.

Thanks
--
David Jorm / Red Hat Product Security