Remote Code Execution

Remote Code Execution is possible due to unsafe handling of XSL templates in the Report Browser, which can lead to a complete workstation takeover.

XSL- Enable - False

In XSL settings, a property-enabled script is set to FALSE by default. No user can directly run the script from the XSL file.

Figure 1. Environment Variable dialog
Figure 2. Enable False- Waring

XSL- Enable - True

If it is a requirement, an environmental variable has been provided which can be set to TRUE and the script can run the xsl file.

Figure 3. Edit User Variable

Environmental variable to be added - XsltEnableScript.

Figure 4. Enable Script- Edit Option