Abusing XSLT for Practical Attacks

Understanding XSLT and the XML Processing Attack Surface

Fernando Arnaboldi of IOActive examines XML Stylesheet Language Transformations (XSLT), a Turing-complete language used by enterprise applications to convert XML documents into HTML, PDF, or alternative XML formats. Many developers overlook that untrusted XSLT stylesheets represent an expansive execution environment susceptible to severe exploitation.

Arbitrary File Disclosure and SSRF Vectors

Arnaboldi demonstrates how standard XSLT elements like document() can be abused to read local server files and perform Server-Side Request Forgery (SSRF) against internal network infrastructure. Attackers who can influence stylesheet inputs can exfiltrate sensitive system configurations and credentials.

Remote Code Execution via Native Extension Functions

The presentation details how vendor-specific extension mechanisms in popular XSLT engines (including Libxslt, Saxon, and Microsoft .NET XslCompiledTransform) permit arbitrary code execution. By embedding Java, C#, or external scripting calls directly within transformation templates, attackers can execute commands with the privileges of the web server.

Cryptographic Predictability in EXSLT Randomness

Beyond command execution, Arnaboldi reveals vulnerabilities in EXSLT random number generator implementations, showing that standard random() functions produce predictable pseudo-random output. Remediation requires disabling external entity resolution, restricting script extensions, and treating all XSLT templates as untrusted executable code.

(AI summary — Gemini 3.8 Flash)