Changes for page Application_Liferay

Last modified by Nicolas Gregoire on 2012/04/19 14:05

From version

edited by Nicolas Gregoire
on 2012/01/13 14:08

Change comment: There is no comment for this version

To version

edited by Nicolas Gregoire
on 2012/01/13 14:19

Change comment: Added tag [liferay, java, xalan-j, code execution, xee]

Summary

Page properties

Tags

...	...	@@ -1,0 +1,1 @@
	1	+liferay\|java\|xalan-j\|code execution\|xee

Content

@@ -4,9 +4,8 @@
++The vulnerabilities described here were patched in version 6.0.6 GA (cf. the [[Release Notes for 6.0.6 GA>>http://issues.liferay.com/secure/ReleaseNote.jspa?version=10656&styleName=Html&projectId=10952||rel="__blank"]]).
--
--
  == Java code execution ==
  LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is [[Xalan-J>>Engine_Saxon]] (but this can probably modified easily using [[JAXP>>http://en.wikipedia.org/wiki/Java_API_for_XML_Processing||rel="__blank"]]). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : [[CVE-2011-1571>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1571||rel="__blank"]].
@@ -25,8 +25,5 @@
  * CVE-2011-1502 : allows to read UTF-8 files and to list directories via a XEE (XML External Entity) attack
--
--
  Reading /etc/passwd using CVE-2011-1502 :
--
  [[image:liferay-read-etc-passwd-via-xee.png||style="display: block; margin-left: auto; margin-right: auto"]]