Changes for page Application_Webkit

Last modified by Nicolas Gregoire on 2012/01/14 17:48
<
From version < 2.1 >
edited by Nicolas Gregoire
on 2012/01/13 21:54
To version < 3.1 >
edited by Nicolas Gregoire
on 2012/01/13 21:59
>
Change comment: There is no comment for this version

Summary

Details

Icon Page properties
Content
... ... @@ -24,3 +24,6 @@
24 24  == File creation vulnerability ==
25 25  
26 26  Webkit uses [[libxslt>>Engine_libxslt]] as its XSLT engine. Old versions were not restricting __write__ access by the engine to the file system, leading to a remotely exploitable vulnerability ([[CVE-2011-1774>>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1774||rel="__blank"]]). This was patched in [[Changeset 79159>>http://trac.webkit.org/changeset/79159||rel="__blank"]] by adding appropriate calls to xsltSetSecurityPrefs().
27 +
28 +
29 +PoC included on the [[libxslt>>Engine_libxslt]] page are enough to demonstrate the vulnerability. A auxiliary plugin is available in Metasploit

Welcome

Welcome on the XSLT Hacking Encyclopedia !

You may be interested by the Engines and Applications pages.

Link to the blog
Twitter: @Agarri_FR

Recently Modified

$msg.get("xe.tag.tagcloud") | Default Class Sheet | Activity Stream |  Attachments | Space Index

Tag Cloud

Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xhe:XWiki.TagCloud]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Content by Nicolas Grégoire / Agarri
Blog - Follow me @Agarri_FR