GoogleIt Mail IT Print IT PermaLinkDomino BaseTarget And Src Vulnerabilities
11:07:46 AM
Written By : Richard SchwartzCategory : Crypto
Location : Nashua, NH

A couple of advisories caught my eye in BlogDigger feeds in the past couple of days: one from Secunia and one from OSVDB. Both refer to issues related to optional -- and AFIAK undocumented -- arguments in Domino server URLs. IBM has apparently been advised, but the links to IBM responses in both advisories are broken. Still, it appears that these advisories are real. How severe they are isn't immediately apparent, but I think it's safe to assume that depending on details of application design they could range from totally benign to potentially very important.


I took the time to verify that &BaseTarget is indeed an optional argument to the ?OpenForm URL command. Whatever you put into it is passed through into the HTML source of the resulting page. I set up a URL with "&BaseTarget=foo", and this is the resulting HTML source on 6.54:


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base target="foo"> <script language="JavaScript" type="text/javascript"> <!-- document._domino_target = "foo"; function _doClick(v, o, t, h) { var form = document._simpleform; if (form.onsubmit) { var retVal = form.onsubmit(); if (typeof retVal == "boolean" && retVal == false) return false; } var target = document._domino_target; if (o.href != null) { if (o.target != null) target = o.target; } else { if (t != null) target = t; } form.target = target; form.__Click.value = v; if (h != null) form.action += h; form.submit(); return false; } // --> </script> </head> <body text="#000000" bgcolor="#FFFFFF"> <form method="post" action="/test/test.nsf/simpleform?OpenForm&Seq=1&BaseTarget=foo" name="_simpleform"> <input type="hidden" name="__Click" value="0"><br> etc., etc., etc. </body> </html>

Depending on the application design, a maliciously constructed URL that contains executable Javascript in the &BaseTarget argument could result in a number of bad things happening. The first of the two lines of HTML that I highlit in red shows the problem. Whatever is put into that argument ends up embedded within Domino-generated executable JavaScript. The fact that it is enclosed in quotes will not prevent code execution, because the quotes can be closed in the URL.


Pending a fix from IBM that covers not just &BaseTarget and &Src, but all optional URL arguments -- whether documented or not -- it seems to me that it would be prudent to add a WebQueryOpen script to every form that is used in Domino web applications and have that code detect any attempt to pass any unexpected URL arguments and redirect to an error page if necessary. And there may be other things that we should be doing.

This page has been accessed 557 times. .
Comments :v

1. vesoftware11/05/2013 10:21:23 PM
Homepage: http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html


Agen Bola Promo 100% SBOBET IBCBET Casino Poker Tangkas Online
http://vesoftware.blogspot.com/2013/10/agen-bola-promo-100-sbobet-ibcbet.html
ITUPOKER.COM AGEN POKER ONLINE INDONESIA TERPERCAYA
http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html
alfaonline.com : Toko belanja online murah, Promo heboh jual barang hanya Rp 1,-
http://vesoftware.blogspot.com/2013/10/alfaonlinecom-toko-belanja-online-murah.html
BELAJAR SEO
http://balapseo.blogspot.com/




2. kota malang03/27/2016 09:29:37 AM
Homepage: http://www.naturalsunrisetour.com/paket-wisata-malang-batu-city-tour-2-hari-1-malam


Pernah denger danau ranu kumbolo? Ya, danau indah ini terletak di gunung semeru http://madas.beep.com/estimasi-waktu-pendakian-gunung-semeru-2015-12-03.htm dan masuk dalam kawasan taman nasional bromo tengger semeru. Danau ranu kumbolo merupakan daya tarik para pendaki untuk mengunjungi gunung semeru. Jika anda membutuhkan paket wisata bromo dan danau ranu kumbolo http://infoterkini.hatenablog.com/entry/2015/12/06/211510 tanpa harus menuju puncak gunung semeru maka silahkan pesan guide dan porter pada kami. Info lengkap tentang paket wisata murah ke bromo dan danau ranu kumbolo baca di paket wisata bromo ranu kumbolo http://infoterkini.hatenablog.com/

Madas Trans merupakan perusahaan jasa sewa menyewa mobil http://www.chairulumam.abatasa.co.id/post/detail/82986/sewa-mobil-alphard-di-kota-malang-dan-surabaya.html yang terletak di empat kota besar yaitu di Surabaya, Jogja, Malang dan Denpasar Bali. Tidak hanya sekedar sewa mobil saja, Madas Trans juga menyediakan beragam paket wisata murah yang akan siap melayani perjalanan wisata anda di 4 kota besar tersebut khususnya dan umumnya untuk daerah Jawa Timur karena kantor pusat sewa mobil http://tubeltkadal.livejournal.com/615.html Madas Trans terletak di Kota Surabaya.

Jika ingin memesan jasa sewa mobil http://catatanartikel.blog.com/2016/02/03/memilih-rental-mobil-online-malang/ dan paket wisata murah tersebut anda bisa menghubungi nomor telkomsel 085204788678 dan tentunya pelayanan yang ramah dari customer service akan menyambut anda dengan senang hati. Banyak armada pilihan sewa mobil di madas trans http://catatandiary.jimdo.com/2016/01/26/serba-serbi-sewa-mobil-pengantin/ tersebut seperti sewa mobil avanza di jogja https://tobielblog.wordpress.com/2016/02/20/bagaimana-menetapkan-harga-sewa-mobil-di-jogja-yang-pas/ sewa mobil innova, rental mobil xenia, sewa mobil elf pariwisata baik short atau pun long, sewa hiace commuter dan sewa bus mini serta rental bus pariwisata.

Sopir sewa mobil yang disediakan di Madas Trans akan menjadi guide perjalanan wisata Anda. Motto utama dari berdirinya Madas Trans tersebut adalah “YOUR COMPLETE GUIDE” dan kami pastikan Anda akan merasakan kepuasan setelah menggunakan jasa sewa mobil http://extreme-guide.blogspot.co.id/2016/02/harga-sewa-mobil-bulanan-di-surabaya.html di tempat kami karena kami sudah lama malang melintang dalam usaha sewa menyewa mobil http://justshare.hatenadiary.com/entry/2016/02/03/Tarif_Sewa_Mobil_Di_Batu_Malang dan sudah berdiri sejak tahun 2013 silam. Jika ada yang kurang paham dan timbul pertanyaan terkait dengan sewa rental mobil dan paket wisata yang kami tawarkan maka silahkan hubungi CS kami. Jangan sungkan dan jangan ragu.




3. discount09/14/2016 09:54:36 AM
Homepage: http://c5sale.com/



http://c5sale.com/ ,




4. dongdong811/17/2017 11:21:19 PM


http://www.uggclearancesale.us.com
http://www.pandoracharms.us.org
http://www.uggaustraliaboots.me.uk
http://www.canada-goosejacka.se
http://www.uggoutlets.com.co
http://www.katespadeoutletstore.us.org
http://www.cheapraybansunglasses.net.co
http://www.nikeairmaxschweiz.ch
http://www.ukuggboots.co.uk
http://www.hollistercooutlet.us.com
http://www.michaelkors--outlet.us.com
http://www.nike-air-huarache.org.uk
http://www.suprashoesclearance.us.com
http://www.cheaprolexwatches.us.com
http://www.ralphlauren-outletstores.us.com
http://www.discountnike.us.com
http://www.uggbootsoutletcanada.ca
http://www.raybanwayfarersunglasses.us.org
http://www.canadagoosecanada.ca
http://www.poloralphlaurenoutletoff.us.com
http://www.cheapreplicawatches.us.com
http://www.ugg-bootsonline.us.com
http://www.air-jordanpascher.fr
http://www.outletmichaelkorsuk.co.uk
http://www.nikenfljerseysfreeshipping.us
http://www.north-face-outlet.in.net
http://www.moncler--paris.fr
http://www.coach-bags.us.org
http://www.nikeairmax.me.uk
http://www.cheap-jordans.us.com
http://www.airmaxnike.me.uk
http://www.uggoutletofficialsite.us.com
http://www.michael-korshandbagsoutlet.us.org
http://www.poloralphlaurenoutlet.org.uk
http://www.christianlouboutinoutletuk.org.uk
http://www.nikeairjordans.co.uk
http://www.nike-factoryoutlet.us.com
http://www.oakleysunglassess.us.org
http://www.michaeljordan-shoes.com
http://www.northfacethe.us.com
http://www.coachoutletonlineshopping.us.org
http://www.jacketmoncler.co.uk
http://www.tory-burch.org.uk
http://www.timberland.us.org
http://www.canadagooseoutlet-online.us.org
http://www.adidasshoessale.in.net
http://www.fitflopssaleclearance.us.org
http://www.prada.us.org
http://www.pandorajewelrycanada.ca
http://www.monclersitoufficiale.it
http://www.manoloblahnik.us
http://www.michaelkorsonline-outlet.us.com
http://www.truereligionsale.com.co
http://www.nikeukstore.org.uk
http://www.michaelkorsoutletonline80off.us.com
http://www.raybansunglassesoutlet.net.co
http://www.adidastore.co.uk
http://www.cheapmlbjerseysshop.us.com
http://www.originalsadidas.co.uk
http://www.blackhawksjersey.com
http://www.korsoutlet.us.com
http://www.coachfactory-outletstoreonline.us.com
http://www.ugg-outlets.com.co
http://www.nikefactory-outlet.us.com
http://www.monclernederland.nl
http://www.nikeairmaxshoes.us.com
http://www.tory-burchoutletonline.us.com
http://www.cheapairjordans.us.com
http://www.outlet-moncler.us
http://www.airjordanretro.fr
http://www.nikeairforce1.net
http://www.rayban.in.net
http://www.cheapnikenfljerseyswholesale.us
http://www.coachoutletsclearance.us.com
http://www.ray-bansunglassessales.us.com
http://www.katespadehandbagssale.us.org
http://www.monclerjassen.be
http://www.pandorajewelry-canada.ca
http://www.coachwallets.us.com
http://www.uggbootsclearance.net.co
http://www.coachoutletonline70off.us.com
http://www.outletlongchamp.us.org
http://www.converseshoesoutlet.us.com
http://www.louboutinoutlets.us.com
http://www.snapbackshatswholesale.us.com
http://www.ugg-australia.com.co
http://www.hermesoutlets.us.com
http://www.nikeoff.com
http://www.uggoutlet70off.us.com
http://www.ferragamoshoesoutlet.us.com
http://www.adidaswings.name
http://www.pradaoutletonlinestore.us.com
http://www.christianlouboutinsale.co.uk
201711.18wengdongdong




Enter Comments^


Email addresses provided are not made available on this site.





You can use UUB Code in your posts.

[b]bold[/b]  [i]italic[/i]  [u]underline[/u]  [s]strikethrough[/s]

URL's will be automatically converted to Links


:-x :cry: :laugh: :-( :cool: :huh: :-) :angry: :-D ;-) :-p :grin: :rolleyes: :-\ :emb: :lips: :-o
bold italic underline Strikethrough





Remember me    

Monthly Archive
Responses Elsewhere



About The Schwartz

rss.jpg


All opinions expressed here are my own, and do not represent positions of my employer.