OSVDB ID: 20981 Title: Google Search Appliance proxystylesheet XSLT Java Code Execution |
Info |
|
|
Dates |
||||
|
|
Description |
The Google Search Appliance contains a flaw that allows a remote attacker to execute arbitrary Java methods as an unprivileged user. The issue is due to the proxystylesheet parameter in the search request, which loads an external XSLT style sheet from a URL. The XSLT parser is based on Saxon, which allows Java method calls from within an XSLT document. This allows an attacker to execute arbitrary code and commands on the appliance. |
Classification |
Location:
Remote/Network Access Required
Attack Type: Other Impact: Loss of Integrity Exploit: Exploit Available Disclosure: OSVDB Verified OSVDB: Web Related |
Solution |
Upgrade to the version specified by Google advisory GA-2005-08-m, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
digitaloffense.net - The Metasploit Project