Hiawatha Webserver Double Free Vulnerability in XSLT 'show_index' Function Allowing Arbitrary Code Execution

A double free vulnerability has been identified in the Hiawatha webserver, specifically in version 11.7. The issue arises within the XSLT 'show_index' function, where improper memory management allows an unauthenticated attacker to exploit the vulnerability, potentially leading to arbitrary code execution. The double free occurs when the same memory is freed multiple times, which can be exploited to manipulate the program's execution flow.

Impact

Exploitation of this vulnerability could result in arbitrary code execution on the server where Hiawatha is running.

Reproduction

The vulnerability can be reproduced by sending a request to a Hiawatha webserver instance running version 11.7, with the 'show_index' XSLT feature enabled. The server must be configured to allow XSLT transformations, and the 'show_index' setting should be set to 'xml' to trigger the vulnerability. Once these conditions are met, the double free can be exploited, leading to arbitrary code execution.