CVE-2019-11068
📋 TL;DR
This vulnerability in libxslt allows attackers to bypass URL access controls by crafting malicious URLs that cause xsltCheckRead to return -1 error codes, which callers incorrectly interpret as permission to load the URL. This affects any application using vulnerable versions of libxslt for XML/XSLT processing, potentially enabling unauthorized file access or remote code execution.
💻 Affected Systems
- libxslt
- Applications using libxslt (e.g., web applications, XML processors, document converters)
📦 What is this software?
E Series Santricity Management Plug Ins by Netapp
View all CVEs affecting E Series Santricity Management Plug Ins →
E Series Santricity Os Controller by Netapp
E Series Santricity Storage Manager by Netapp
View all CVEs affecting E Series Santricity Storage Manager →
E Series Santricity Unified Manager by Netapp
View all CVEs affecting E Series Santricity Unified Manager →
E Series Santricity Web Services Proxy by Netapp
View all CVEs affecting E Series Santricity Web Services Proxy →
Fedora by Fedoraproject
Fedora by Fedoraproject
Jdk by Oracle
Leap by Opensuse
Leap by Opensuse
Leap by Opensuse
Libxslt by Xmlsoft
Solidfire by Netapp
Steelstore Cloud Integrated Storage by Netapp
View all CVEs affecting Steelstore Cloud Integrated Storage →
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file access, information disclosure, or denial of service through crafted XSLT transformations.
If Mitigated
Limited impact with proper network segmentation, application sandboxing, and input validation.
🎯 Exploit Status
Exploitation requires crafting malicious URLs in XSLT documents. Public proof-of-concept demonstrates the bypass mechanism.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libxslt 1.1.34 and later
Vendor Advisory: http://xmlsoft.org/XSLT/
Restart Required: Yes
Instructions:
1. Update libxslt to version 1.1.34 or later using your system package manager. 2. For Linux: Use 'apt-get upgrade libxslt1.1' (Debian/Ubuntu) or 'yum update libxslt' (RHEL/CentOS). 3. Restart any services or applications using libxslt. 4. Recompile any statically linked applications with the updated library.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure XML processors to disable external entity resolution and URL fetching in XSLT transformations.
For libxml2: Set XML_PARSE_NOENT and XML_PARSE_NONET parser options to prevent network access
Input validation and sanitization
allValidate and sanitize all XML/XSLT input before processing to reject malicious URLs.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems using libxslt from untrusted networks.
- Use application sandboxing or containerization to limit the impact of potential exploitation.
🔍 How to Verify
Check if Vulnerable:
Check libxslt version with 'xsltproc --version' or 'dpkg -l libxslt1.1' (Debian) or 'rpm -q libxslt' (RHEL). If version is 1.1.33 or earlier, system is vulnerable.Check Version:
xsltproc --version | head -1Verify Fix Applied:
After update, verify version is 1.1.34 or later using the same commands. Test with known malicious XSLT samples if available.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from XML processing applications
- Errors in application logs related to XSLT parsing failures
- Unexpected network connections from XML processors
Network Indicators:
- Outbound connections from XML processors to unexpected URLs
- Large or unusual data transfers following XML processing
SIEM Query:
source="application_logs" AND ("xslt" OR "libxslt") AND (error OR failure OR "-1")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/04/22/1
- http://www.openwall.com/lists/oss-security/2019/04/23/5
- https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
- https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/
- https://security.netapp.com/advisory/ntap-20191017-0001/
- https://usn.ubuntu.com/3947-1/
- https://usn.ubuntu.com/3947-2/
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00052.html
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00053.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/04/22/1
- http://www.openwall.com/lists/oss-security/2019/04/23/5
- https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
- https://lists.debian.org/debian-lts-announce/2019/04/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36TEYN37XCCKN2XUMRTBBW67BPNMSW4K/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCOAX2IHUMKCM3ILHTMGLHCDSBTLP2JU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SK4YNISS22MJY22YX5I6V2U63QZAUEHA/
- https://security.netapp.com/advisory/ntap-20191017-0001/
- https://usn.ubuntu.com/3947-1/
- https://usn.ubuntu.com/3947-2/
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
