full-disclosure

Open Source and information security mailing list archives

Date: Wed, 27 May 2015 23:46:05 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>,
	<fulldisclosure@...lists.org>
Subject: [FD] XSS vulnerability in IBM Domino

Hello list!

I want to warn you about Cross-Site Scripting vulnerability in IBM Domino. 
This is one from many vulnerabilities in Domino, which I've found at 
03.05.2012. In previous years I wrote about multiple vulnerabilities in 
Lotus Domino (http://securityvulns.ru/docs29277.html) and Lotus Notes 
Traveler (http://securityvulns.ru/docs30224.html).

During 2012-2013 I informed IBM that have other holes in Domino (as this 
XSS), besides previous holes, but they were not interested.

-------------------------
Affected products:
-------------------------

Vulnerable are IBM Lotus Domino 8.5.3, 8.5.4 (in which I tested) and 
previous versions. Versions Domino 9.0 and 9.0.1 also must be vulnerable 
(since IBM hasn't fix it earlier).

-------------------------
Affected vendors:
-------------------------

IBM Domino (formerly IBM Lotus Domino)
http://www-03.ibm.com/software/products/us/en/ibmdomino/

----------
Details:
----------

Cross-Site Scripting (WASC-08):

http://site/mail/user.nsf/fc9368429d022147c3256c6a005431ff/3c575ad7c19a9ca0c22572b3002d5087/Body/%22;}alert(document.cookie);function%20a(){a=%22

For conducting XSS attack it's needed to know hashes in address of a letter. 
They can be found via information leakage (i.e. embedded image) or via other 
XSS vulnerability.

------------
Timeline:
------------ 

Full timeline read in the first advisory 
(http://securityvulns.ru/docs28474.html).

- During 16.05-20.05.2012 I've wrote announcements about multiple 
vulnerabilities in IBM software at my site.
- During 16.05-20.05.2012 I've wrote five advisories via contact form at IBM 
site.
- At 31.05.2012 I've resend five advisories to IBM PSIRT, which they 
received and said they would send them to the developers (of Lotus 
products).
- At 18.08.2012 I've reminded IBM about multiple holes and gave enough 
arguments to fix them.
- At 14.04.2013 I've again remind IBM about Brute Force and Insufficient 
Authentication holes.
- At 23.04.2013 IBM answered that they would not fix Brute Force and 
Insufficient Authentication holes and don't interested in this XSS.
- During 15.02.2013-26.04.2013 I disclosed at my site about previous 
vulnerabilities IBM Lotus Domino.
- At 26.05.2015 I've disclosed this vulnerability at my site 
(http://websecurity.com.ua/7783/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives