IBM Lotus Domino "user.nsf" Cross-Site Scripting Vulnerability


Description   A vulnerability was reported in IBM Lotus Domino.
A remote attacker could exploit it by enticing their victim into following a specially crafted link in order to execute arbitrary JavaScript or HTML code.
In order to exploit this vulnearbility, the attacker must know hashes in address of a letter.
A proof of concept is available.
     
Vulnerable Products   Vulnerable Software:
Lotus Domino Server (IBM) - 8.5, 8.5.1, 8.5.1 FP1, 8.5.1 FP2, 8.5.1 FP3, ..., 9.0.1 FP2 IF3, 9.0.1 FP3, 9.0.1 FP3 IF1, 9.0.1 FP3 IF2, 9.0.1 FP3 IF3
     
Solution   IBM has released the 8.5.3 Fix Pack 6 IF 8 version for Domino which fixes this vulnerability.
     
CVE   CVE-2015-1981
     
References   - WebSecurity.com.ua : XSS vulnerability in IBM Lotus Domino
http://websecurity.com.ua/7783/
- IBM Security Bulletin: IBM Domino Web Server Cross-site Scripting Vulnerability (CVE-2015-1981)
http://www-01.ibm.com/support/docview.wss?uid=swg21959908
IBM : Notes/Domino 9.0.1 Fix Pack 4 Release Notice
http://www-10.lotus.com/ldd%5Cfixlist.nsf/WhatsNew/6241b6b464080e4585257e280065954a?OpenDocument
- IBM : Domino Web Server Cross-site Scripting Vulnerability (CVE-2015-1981)
http://www-01.ibm.com/support/docview.wss?uid=swg21959908
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : suspicious 'iframe' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'meta' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious tag with event found in URL
3.2.0
XSS - Prevention - GET : suspicious 'applet' tag found in URL
3.2.0
XSS - Phishing : suspicious 'div' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' attribute found in URL
3.2.0
XSS - Prevention - GET : suspicious 'img' tag found in URL
3.2.0
XSS - Phishing : suspicious 'a' tag found in URL
3.2.0
XSS - Prevention - GET : cookie access attempt using script language found in URL
3.2.0
XSS - Prevention - GET : suspicious 'embed' tag found in URL
3.2.0
XSS - Prevention - GET : suspicious 'object' tag found in URL
3.2.0
XSS - Phishing : suspicious 'form' tag found in URL
3.2.0
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - GET : evasion attempt using tag characters encoding in URL
3.2.0
XSS - Prevention - GET : suspicious 'style' tag found in URL
3.2.0
XSS - Phishing : suspicious 'link' tag found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
XSS - Prevention - GET : 'location' javascript object found in URL
3.2.0
XSS - Prevention - GET : suspicious 'div' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2015-05-26 

 Target Type 
Server 

 Possible exploit 
Remote