mailing list archives
Re: CVE affected for PHP 5.3.9 ?
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 13 Jan 2012 13:50:59 -0700
On 01/13/2012 11:08 AM, Nicolas Grégoire wrote:
Le vendredi 13 janvier 2012 à 09:54 -0700, Kurt Seifried a écrit :
I'm not clear on how this crosses a security boundary
Some applications *will* process untrusted XSLT stylesheets.
The most basic example is online XSLT gateways :
You may find more with Google and a dork like [inurl:php
inurl:"xsl=http"]. This is often used to adapt the layout of a page to
the browser (desktop vs. mobile).
There's too some more complex cases where untrusted XSLT may be used,
like parsing SVG images, XML-DSig signatures or SAML tokens, ...
Ok I'm still not clear on what the security claim is. Are you saying you
can cause arbitrary text output via XSL/XML mangling tricks? And
combined with having a script that uses something like "<sax:output
href="0wn3d.php" method="text">" you can put arbitrary text content into
this file which could then result in the file being parsed? The problem
is you'd have to write a script that does this, writes to a local file
with a file ending in .php or .shtml or whatever, in which case it's
pretty clear the script writer MEANT to do that. Again I'm still not
clear on what/how a security boundary is being crossed. How does this
elevate privileges or give you remote access that you wouldn't already
if you can upload arbitrary PHP scripts?
-- Kurt Seifried / Red Hat Security Response Team