PT-2023-8404 · Htmlunit+1 · Htmlunit+1

Published 2023-12-03 · Updated 2026-05-05 · CVE-2023-49093

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HtmlUnit versions prior to 3.9.0

Description HtmlUnit is a GUI-less browser for Java programs that is vulnerable to Remote Code Execution (RCE) via XSTL when browsing an attacker's webpage. The reason for the vulnerability is that the FEATURE SECURE PROCESSING was not enabled for the XSLT processor. This issue can be exploited by an attacker to execute arbitrary code. The vulnerability is located in the org.htmlunit.activex.javascript.msxml.XSLProcessor#transform function.

Recommendations For versions prior to 3.9.0, update to version 3.9.0 to fix the vulnerability. As a temporary workaround, consider disabling the XSLT processor or restricting access to it until a patch is available. Avoid using the XSLT processor to parse untrusted input.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-00652

CVE-2023-49093

GHSA-37VQ-HR2F-G7H7

USN-8220-1

Affected Products

Htmlunit

Ubuntu

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49093.json · Exploit
• 🔥 https://github.com/HtmlUnit/htmlunit/security/advisories/GHSA-37vq-hr2f-g7h7 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49093 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49093 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-37vq-hr2f-g7h7 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8220-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49093 · Security Note
• https://bdu.fstec.ru/vul/2024-00652 · Security Note
• https://ubuntu.com/security/notices/USN-8220-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49093 · Security Note
• https://github.com/HtmlUnit/htmlunit · Note
• https://twitter.com/cracbot/status/1732111506546778439 · Twitter Post
• https://t.me/pentestingnews/41711 · Telegram Post
• https://twitter.com/HtmlUnit/status/1732086187798520108 · Twitter Post