Re: CVE request: Remote code execution via XSL extensions in SpagoBI

[Kurt Seifried <kseifried () redhat com>]

Just to confirm this isn't a troll ;) despite a scary sounding
contributor agreement SpagoBI is Open Source:

http://www.spagoworld.org/xwiki/bin/view/SpagoBI/OpenSource

On 02/10/14 12:40 AM, David Jorm wrote:
> Hi All
>
> Can a CVE ID please be assigned for part 1) of this issue:
>
> https://www.spagoworld.org/jira/browse/SPAGOBI-1885
>
> Anyone who has permission to define a document that uses the
> accessibility engine can supply an XSL file that will be used to
> transform the data in the presentation view. SpagoBI is using Xalan to
> perform the transformation, and there's two problems:
>
> 1) FEATURE_SECURE_PROCESSING is not set. This means an attacker can
> provide an XSL document with embedded Java code, which will be executed
> on the server.
>
> 2) SpagoBI is using Xalan 2.6.0. A flaw in this version means that if
> with FEATURE_SECURE_PROCESSING set, an attacker can bypass the
> restrictions, and provide XSL documents with embedded Java code. To
> address this, you need to upgrade to >= 2.7.2:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0107
>
> I have provided a reproducer to the developers via email.
>
> Thanks
> -- 
> David Jorm / Red Hat Product Security

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature