Security Advisory 4
Date: 2012-04-26
Summary: Remote code execution possible via Web Script XSLT Processor
Related Issues: ALF-13726
Affects: All versions prior to 4.0.1
Fixed in: 3.4.9, with a hotfix for 3.4.8. 4.0.1, with a hotfix available for 4.0.0.
Alfresco’s XSLT processor previously allowed XSLT templates used by web scripts and Web Forms to make use of the Apache Xalan extensions feature to call arbitrary Java methods. This could be exploited as a security hole by anyone with permissions to upload a webscript or XSLT template. We now prevent the use of any extension namespaces besides the preconfigured Alfresco 'alf' namespace.
With the fix in place, the Xalan extensions cannot call arbitrary methods because the only extensions allowed are Alfresco's. If you need to call your own Java code through a Xalan extension, you can still configure the XSLT processor to do that.
The code that implements this fix is in the Jira. This should allow you to patch the JAR if you cannot wait for the next Community Edition drop.
Security Advisories
