Changes for page Application_Liferay

Summary

• Page properties (1 modified, 0 added, 0 removed)
• Attachments (0 modified, 0 added, 2 removed)
  • liferay-execute-commands-with-stdout.png
  • liferay-read-etc-passwd-via-xee.png

Details

Page properties

Content

...	...	@@ -6,23 +6,14 @@
6	6
7	7
8	8
	9	+LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is [[Xalan-J>>Engine_Saxon]] (but this can probably modified easily using [[JAXP>>http://en.wikipedia.org/wiki/Java_API_for_XML_Processing||rel="__blank"]]). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : [[CVE-2011-1571>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1571||rel="__blank"]].
9	9
10		-== Java code execution ==
11	11
12		-LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is [[Xalan-J>>Engine_Saxon]] (but this can probably modified easily using [[JAXP>>http://en.wikipedia.org/wiki/Java_API_for_XML_Processing||rel="__blank"]]). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : [[CVE-2011-1571>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1571||rel="__blank"]].
13	13
14	14
15		-== Additional vulnerabilities ==
16	16
17		-Two others vulnerabilities were identified in the "XSL Content" portlet :
	15	+__Note :__ Two others vulnerabilities were identified in the "XSL Content" portlet :
18	18
19	19	* CVE-2011-1503 : allows to read XML files via a file:~/~/ URL
20	20
21	21	* CVE-2011-1502 : allows to read UTF-8 files and to list directories via a XEE (XML External Entity) attack
22		-
23		-
24		-
25		-
26		-Reading /etc/passwd using CVE-2011-1502 :
27		-
28		-[[image:liferay-read-etc-passwd-via-xee.png||style="display: block; margin-left: auto; margin-right: auto"]]

liferay-execute-commands-with-stdout.png

Author

...	...	@@ -1,1 +1,0 @@
1		-xwiki:XWiki.NicolasGregoire

Size

...	...	@@ -1,1 +1,0 @@
1		-77.9 KB

Content

liferay-read-etc-passwd-via-xee.png

Author

...	...	@@ -1,1 +1,0 @@
1		-xwiki:XWiki.NicolasGregoire

Size

...	...	@@ -1,1 +1,0 @@
1		-64.6 KB

Content