CVE-2023-49093

Overview

HtmlUnit is a browser library for Java programs that operates without a graphical interface. It models HTML documents and lets applications load pages, fill forms, follow links, and execute JavaScript with configurable browser behavior. It is used for automated web testing and retrieving information from websites.

A remote code execution vulnerability (CVE-2023-49093) has been identified in the MSXML XSLProcessor of HtmlUnit's Internet Explorer emulation, which allows attackers to run arbitrary Java code on the host when HtmlUnit loads an attacker-controlled page.

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application.

This issue affects multiple versions of HtmlUnit.

Details

Module Info

• Product: HtmlUnit
• Affected packages: net.sourceforge.htmlunit:htmlunit, org.htmlunit:htmlunit
• Affected versions:
  • net.sourceforge.htmlunit:htmlunit: <=2.70.0
  • org.htmlunit:htmlunit: <3.9.0
• GitHub repository: https://github.com/HtmlUnit/htmlunit
• Published packages: https://central.sonatype.com/artifact/net.sourceforge.htmlunit/htmlunit, https://central.sonatype.com/artifact/org.htmlunit/htmlunit
• Package manager: Maven
• Fixed in:
  • OSS HtmlUnit 3.9.0
  • NES for HtmlUnit v2.60.3

Vulnerability Info

This Critical-severity vulnerability is found in the net.sourceforge.htmlunit:htmlunit and org.htmlunit:htmlunit packages in multiple versions of HtmlUnit. When a WebClient emulates Internet Explorer, page scripts can create MSXML ActiveX objects such as Msxml2.XSLTemplate and Msxml2.FreeThreadedDOMDocument, load an XSLT stylesheet of their choosing, and run it through the processor returned by createProcessor(). The processor's transform() call ends in XSLProcessor.transform(XMLDOMNode), which compiles the page-supplied stylesheet with a default JAXP TransformerFactory:

final DOMResult result = new DOMResult(containerElement);

final Transformer transformer = TransformerFactory.newInstance().newTransformer(xsltSource);
for (final Map.Entry<String, Object> entry : parameters_.entrySet()) {
    transformer.setParameter(entry.getKey(), entry.getValue());
}
transformer.transform(xmlSource, result);

The JDK enables XMLConstants.FEATURE_SECURE_PROCESSING by default for DOM and SAX parsers, but not for transformers, and nothing in this code turns it on. Without secure processing, the XSLT engine resolves Xalan Java extension namespaces such as http://xml.apache.org/xalan/java/java.lang.Runtime, so a stylesheet can call arbitrary Java methods, including Runtime.exec, while it is being transformed. A page that HtmlUnit loads with Internet Explorer emulation can therefore execute commands with the privileges of the Java process running HtmlUnit.

Mitigation

HtmlUnit security fixes are made on the current development branch on a best-effort basis. Older releases should be migrated to a current release that contains the fix. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a current version of HtmlUnit that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.