Anyone who has permission to define a document that uses the accessibility engine can supply an XSL file that will be used to transform the data in the presentation view. SpagoBI is using Xalan to perform the transformation, and there's two problems:
1) FEATURE_SECURE_PROCESSING is not set. This means an attacker can provide an XSL document with embedded Java code, which will be executed on the server.
2) SpagoBI is using Xalan 2.6.0. A flaw in this version means that if with FEATURE_SECURE_PROCESSING set, an attacker can bypass the restrictions, and provide XSL documents with embedded Java code. To address this, you need to upgrade to >= 2.7.2:
Details
People
Dates
Description
Anyone who has permission to define a document that uses the accessibility engine can supply an XSL file that will be used to transform the data in the presentation view. SpagoBI is using Xalan to perform the transformation, and there's two problems:
1) FEATURE_SECURE_PROCESSING is not set. This means an attacker can provide an XSL document with embedded Java code, which will be executed on the server.
2) SpagoBI is using Xalan 2.6.0. A flaw in this version means that if with FEATURE_SECURE_PROCESSING set, an attacker can bypass the restrictions, and provide XSL documents with embedded Java code. To address this, you need to upgrade to >= 2.7.2:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0107
I have provided a reproducer to the developers via email.
Comments
Angelo Bernabei added a comment - 2014-10-02T13:43:34.810+0200
Thanks we will fix this issue in the next release ( scheduled for mid-November )
David Jorm added a comment - 2014-10-03T05:35:43.817+0200
Thanks Angelo. This issue has been assigned CVE-2014-7296.