Changes for page Application_Liferay

Last modified by Nicolas Gregoire on 2012/04/19 14:05
From version Icon 2.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 14:00
Change comment: There is no comment for this version
To version Icon 3.1 Icon
edited by Nicolas Gregoire
on 2012/01/13 14:02
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -6,14 +6,20 @@
6 6  
7 7  
8 8  
9 +
10 +== Java code execution ==
11 +
9 9  LIferay includes numerous portlets. The "XSL Content" portlet displays the result of the XSL transformation of a XML document. The XSLT engine used by default is [[Xalan-J>>Engine_Saxon]] (but this can probably modified easily using [[JAXP>>http://en.wikipedia.org/wiki/Java_API_for_XML_Processing||rel="__blank"]]). As Xalan-J allows by default to execute Java code from the stylesheet, that's an easy to exploit vulnerability. Any logged-in user can execute arbitrary Java code in the context of the Web Application server (usually Tomcat) : [[CVE-2011-1571>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1571||rel="__blank"]].
10 10  
11 11  
15 +== Additional vulnerabilities ==
12 12  
13 13  
14 14  
15 -__Note :__ Two others vulnerabilities were identified in the "XSL Content" portlet :
16 16  
20 +
21 +Two others vulnerabilities were identified in the "XSL Content" portlet :
22 +
17 17  * CVE-2011-1503 : allows to read XML files via a file:~/~/ URL
18 18  
19 19  * CVE-2011-1502 : allows to read UTF-8 files and to list directories via a XEE (XML External Entity) attack