SA-4

Document created by resplin Employee on Mar 13, 2015Last modified by resplin Employee on Oct 6, 2016
Version 2Show Document
  • View in full screen mode

Security Advisory 4


Date: 2012-04-26

Summary: Remote code execution possible via Web Script XSLT Processor

Related Issues: ALF-13726

Affects: All versions prior to 4.0.1

Fixed in: 3.4.9, with a hotfix for 3.4.8. 4.0.1, with a hotfix available for 4.0.0.

Alfresco’s XSLT processor previously allowed XSLT templates used by web scripts and Web Forms to make use of the Apache Xalan extensions feature to call arbitrary Java methods. This could be exploited as a security hole by anyone with permissions to upload a webscript or XSLT template. We now prevent the use of any extension namespaces besides the preconfigured Alfresco 'alf' namespace.

With the fix in place, the Xalan extensions cannot call arbitrary methods because the only extensions allowed are Alfresco's. If you need to call your own Java code through a Xalan extension, you can still configure the XSLT processor to do that.

The code that implements this fix is in the Jira. This should allow you to patch the JAR if you cannot wait for the next Community Edition drop.

Security Advisories

Attachments

    Outcomes