CVE-2012-5358
📋 TL;DR
This vulnerability in Ektron CMS allows remote attackers to read arbitrary files via crafted XSL data due to insecure XSLT configuration. Attackers can bypass authentication, modify viewstate, cause denial of service, or potentially execute other malicious actions. Affects Ektron CMS installations before version 8.02 SP5.
💻 Affected Systems
- Ektron Content Management System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including arbitrary file read, authentication bypass, potential remote code execution, and full control of the CMS instance.
Likely Case
Unauthorized file access leading to credential theft, configuration disclosure, and authentication bypass to gain administrative privileges.
If Mitigated
Limited impact with proper network segmentation, but still potential for information disclosure from accessible files.
🎯 Exploit Status
Public exploit details and proof-of-concept code are available online. Attack requires sending crafted XSL data to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.02 SP5
Vendor Advisory: http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm
Restart Required: Yes
Instructions:
1. Backup your Ektron installation and database. 2. Download and install Ektron CMS 8.02 SP5 from official sources. 3. Apply the update following Ektron's upgrade documentation. 4. Restart the application server and verify functionality.
🔧 Temporary Workarounds
Disable document function in XSLT
allModify XSLT configuration to set enableDocumentFunction to false in XSLTCompiledTransform usage.
Modify XSLT configuration in code: XsltSettings.EnableDocumentFunction = false
Input validation for XSL data
allImplement strict input validation and sanitization for all XSL data inputs.
Implement input validation in code to reject suspicious XSL patterns
🧯 If You Can't Patch
- Implement strict WAF rules to block requests containing XSL document() function calls
- Network segmentation to isolate Ektron servers and restrict access to sensitive file systems
🔍 How to Verify
Check if Vulnerable:
Check Ektron CMS version in administration panel or web.config file. If version is below 8.02 SP5, system is vulnerable.Check Version:
Check Ektron web.config file for version information or login to Ektron admin panelVerify Fix Applied:
Verify version is 8.02 SP5 or higher in administration panel. Test XSLT functionality to ensure document() function is disabled.📡 Detection & Monitoring
Log Indicators:
- Unusual XSL file uploads or requests
- Multiple failed authentication attempts after XSL requests
- Access to sensitive system files via web requests
Network Indicators:
- HTTP requests containing XSL document() function calls
- Unusual file read patterns from web server
SIEM Query:
source="web_server" AND (uri="*.xsl" OR uri="*.xslt") AND (request_body CONTAINS "document(" OR response_size > 1000000)🔗 References
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm
- https://technet.microsoft.com/library/security/msvr12-016
- https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/
- http://documentation.ektron.com/current/ReleaseNotes/Release8/8.02SP5.htm
- https://technet.microsoft.com/library/security/msvr12-016
- https://webstersprodigy.net/2012/10/25/cve-2012-5357cve-1012-5358-cool-ektron-xslt-rce-bugs/
