Vigil@nce: PHP, file creation via XSLT
February 2012 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
When a PHP application processes a malicious XSLT file, an
attacker can create a file on the system.
– Severity: 2/4
– Creation date: 18/01/2012
IMPACTED PRODUCTS
– Debian Linux
– PHP
DESCRIPTION OF THE VULNERABILITY
The PHP XSLTProcessor->transformToXML() method is used to process
an XML file with a XSLT (transformation) style sheet.
The libxslt library can save the result of an XSL transformation
to a file. For example, the "href" attribute of the "<sax:output
..." (SAXON) element indicates the file name.
However, PHP, which uses libxslt, does not disable this feature.
The transformToXML() method thus generates a file on the computer.
When a PHP application processes a malicious XSLT file, an
attacker can therefore create a file on the system.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/PHP-file-creation-via-XSLT-11302