Lotus Notes/Domino Square Bracket Encoding Failure Lets Remote Users Conduct Cross-Site Scripting Attacks
|
|
SecurityTracker Alert ID: 1011779
|
|
SecurityTracker URL: http://securitytracker.com/id?1011779
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Oct 19 2004
|
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information
|
Exploit Included: Yes
|
Version(s): R6
|
Description: An input validation vulnerability was reported in Lotus Notes/Domino in the processing of computed values containing square brackets. A remote user can conduct cross-site scripting attacks.
Juan C Calderon reported that the Lotus Notes HTML encoding function fails to encode square brackes ('[' and ']'). A remote user
can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the
target user's browser. The code will originate from the site running the Notes/Domino software and will run in the security context
of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any,
associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site
acting as the target user.
A demonstration exploit URL is provided:
http://[target]/FormReflectingURLValue?OpenForm&Field=[<script>.....</script>]
The
exploit does not work in editable fields.
|
Impact: A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the
Notes/Domino software, access data recently submitted by the target user via web form to the site, or take actions on the site acting
as the target user.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.ibm.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), Windows (NT), Windows (2000)
|
Reported By: Juan C Calderon <juan.calderon@ge.com>
|
Message History:
None.
|
Source Message Contents
|
Date: 18 Oct 2004 18:48:17 -0000
From: Juan C Calderon <juan.calderon@ge.com>
Subject: IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ] )
|
Software:
IBM Lotus Notes/Domino
Affected Version(s):
Tested in R6 should work in prior versions as well.
Author:
Juan C Calderon
Description:
An attacker can bypass native Lotus Notes HTML encoding in a computed value by adding square brackets
to the beginning and end of
a field of the following types computed, computed for display, computed when composed or a "com
puted text" element, Injecting HTML
and JavaScript as desired.
NOTE: This won't work in editable fields
Trivial Example:
http://www.SomeLotusSite.com/FormReflectingURLValue?OpenForm&Field=[<script>.....&
lt;/script>]
Solution:
Validate user input for square bracket characters ( [ ] ) in data shown directly or indirectly in co
mputed fields/texts
|
|
