CVE-2011-1571

Related Files

Liferay XSL Command Execution

Posted Apr 7, 2012

Authored by Nicolas Gregoire, Spencer McIntyre | Site metasploit.com

This Metasploit module exploits a vulnerability in the XSL parser of the XSL Content Portlet. When Tomcat is present, arbitrary code can be executed via java calls in the data fed to the Xalan XSLT processor. If XSLPAGE is defined, the user must have rights to change the content of that page (to add a new XSL portlet), otherwise it can be left blank and a new one will be created. The second method however, requires administrative privileges.

tags | exploit, java, arbitrary

advisories | CVE-2011-1571, OSVDB-73652

SHA-256 | 7495092f0f3708dd15dbc023f72927b1df95d3321e5d2ee8abfac8bf7f05f086

Download | Favorite | View