GoogleIt Mail IT Print IT PermaLinkDomino BaseTarget And Src Vulnerabilities
11:07:46 AM
Written By : Richard SchwartzCategory : Crypto
Location : Nashua, NH

A couple of advisories caught my eye in BlogDigger feeds in the past couple of days: one from Secunia and one from OSVDB. Both refer to issues related to optional -- and AFIAK undocumented -- arguments in Domino server URLs. IBM has apparently been advised, but the links to IBM responses in both advisories are broken. Still, it appears that these advisories are real. How severe they are isn't immediately apparent, but I think it's safe to assume that depending on details of application design they could range from totally benign to potentially very important.


I took the time to verify that &BaseTarget is indeed an optional argument to the ?OpenForm URL command. Whatever you put into it is passed through into the HTML source of the resulting page. I set up a URL with "&BaseTarget=foo", and this is the resulting HTML source on 6.54:


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <base target="foo"> <script language="JavaScript" type="text/javascript"> <!-- document._domino_target = "foo"; function _doClick(v, o, t, h) { var form = document._simpleform; if (form.onsubmit) { var retVal = form.onsubmit(); if (typeof retVal == "boolean" && retVal == false) return false; } var target = document._domino_target; if (o.href != null) { if (o.target != null) target = o.target; } else { if (t != null) target = t; } form.target = target; form.__Click.value = v; if (h != null) form.action += h; form.submit(); return false; } // --> </script> </head> <body text="#000000" bgcolor="#FFFFFF"> <form method="post" action="/test/test.nsf/simpleform?OpenForm&Seq=1&BaseTarget=foo" name="_simpleform"> <input type="hidden" name="__Click" value="0"><br> etc., etc., etc. </body> </html>

Depending on the application design, a maliciously constructed URL that contains executable Javascript in the &BaseTarget argument could result in a number of bad things happening. The first of the two lines of HTML that I highlit in red shows the problem. Whatever is put into that argument ends up embedded within Domino-generated executable JavaScript. The fact that it is enclosed in quotes will not prevent code execution, because the quotes can be closed in the URL.


Pending a fix from IBM that covers not just &BaseTarget and &Src, but all optional URL arguments -- whether documented or not -- it seems to me that it would be prudent to add a WebQueryOpen script to every form that is used in Domino web applications and have that code detect any attempt to pass any unexpected URL arguments and redirect to an error page if necessary. And there may be other things that we should be doing.

This page has been accessed 565 times. .
Comments :v

1. vesoftware11/05/2013 10:21:23 PM
Homepage: http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html


Agen Bola Promo 100% SBOBET IBCBET Casino Poker Tangkas Online
http://vesoftware.blogspot.com/2013/10/agen-bola-promo-100-sbobet-ibcbet.html
ITUPOKER.COM AGEN POKER ONLINE INDONESIA TERPERCAYA
http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html
alfaonline.com : Toko belanja online murah, Promo heboh jual barang hanya Rp 1,-
http://vesoftware.blogspot.com/2013/10/alfaonlinecom-toko-belanja-online-murah.html
BELAJAR SEO
http://balapseo.blogspot.com/




2. kota malang03/27/2016 09:29:37 AM
Homepage: http://www.naturalsunrisetour.com/paket-wisata-malang-batu-city-tour-2-hari-1-malam


Pernah denger danau ranu kumbolo? Ya, danau indah ini terletak di gunung semeru http://madas.beep.com/estimasi-waktu-pendakian-gunung-semeru-2015-12-03.htm dan masuk dalam kawasan taman nasional bromo tengger semeru. Danau ranu kumbolo merupakan daya tarik para pendaki untuk mengunjungi gunung semeru. Jika anda membutuhkan paket wisata bromo dan danau ranu kumbolo http://infoterkini.hatenablog.com/entry/2015/12/06/211510 tanpa harus menuju puncak gunung semeru maka silahkan pesan guide dan porter pada kami. Info lengkap tentang paket wisata murah ke bromo dan danau ranu kumbolo baca di paket wisata bromo ranu kumbolo http://infoterkini.hatenablog.com/

Madas Trans merupakan perusahaan jasa sewa menyewa mobil http://www.chairulumam.abatasa.co.id/post/detail/82986/sewa-mobil-alphard-di-kota-malang-dan-surabaya.html yang terletak di empat kota besar yaitu di Surabaya, Jogja, Malang dan Denpasar Bali. Tidak hanya sekedar sewa mobil saja, Madas Trans juga menyediakan beragam paket wisata murah yang akan siap melayani perjalanan wisata anda di 4 kota besar tersebut khususnya dan umumnya untuk daerah Jawa Timur karena kantor pusat sewa mobil http://tubeltkadal.livejournal.com/615.html Madas Trans terletak di Kota Surabaya.

Jika ingin memesan jasa sewa mobil http://catatanartikel.blog.com/2016/02/03/memilih-rental-mobil-online-malang/ dan paket wisata murah tersebut anda bisa menghubungi nomor telkomsel 085204788678 dan tentunya pelayanan yang ramah dari customer service akan menyambut anda dengan senang hati. Banyak armada pilihan sewa mobil di madas trans http://catatandiary.jimdo.com/2016/01/26/serba-serbi-sewa-mobil-pengantin/ tersebut seperti sewa mobil avanza di jogja https://tobielblog.wordpress.com/2016/02/20/bagaimana-menetapkan-harga-sewa-mobil-di-jogja-yang-pas/ sewa mobil innova, rental mobil xenia, sewa mobil elf pariwisata baik short atau pun long, sewa hiace commuter dan sewa bus mini serta rental bus pariwisata.

Sopir sewa mobil yang disediakan di Madas Trans akan menjadi guide perjalanan wisata Anda. Motto utama dari berdirinya Madas Trans tersebut adalah “YOUR COMPLETE GUIDE” dan kami pastikan Anda akan merasakan kepuasan setelah menggunakan jasa sewa mobil http://extreme-guide.blogspot.co.id/2016/02/harga-sewa-mobil-bulanan-di-surabaya.html di tempat kami karena kami sudah lama malang melintang dalam usaha sewa menyewa mobil http://justshare.hatenadiary.com/entry/2016/02/03/Tarif_Sewa_Mobil_Di_Batu_Malang dan sudah berdiri sejak tahun 2013 silam. Jika ada yang kurang paham dan timbul pertanyaan terkait dengan sewa rental mobil dan paket wisata yang kami tawarkan maka silahkan hubungi CS kami. Jangan sungkan dan jangan ragu.




3. discount09/14/2016 09:54:36 AM
Homepage: http://c5sale.com/



http://c5sale.com/ ,




4. dongdong811/17/2017 11:21:19 PM


http://www.uggclearancesale.us.com
http://www.pandoracharms.us.org
http://www.uggaustraliaboots.me.uk
http://www.canada-goosejacka.se
http://www.uggoutlets.com.co
http://www.katespadeoutletstore.us.org
http://www.cheapraybansunglasses.net.co
http://www.nikeairmaxschweiz.ch
http://www.ukuggboots.co.uk
http://www.hollistercooutlet.us.com
http://www.michaelkors--outlet.us.com
http://www.nike-air-huarache.org.uk
http://www.suprashoesclearance.us.com
http://www.cheaprolexwatches.us.com
http://www.ralphlauren-outletstores.us.com
http://www.discountnike.us.com
http://www.uggbootsoutletcanada.ca
http://www.raybanwayfarersunglasses.us.org
http://www.canadagoosecanada.ca
http://www.poloralphlaurenoutletoff.us.com
http://www.cheapreplicawatches.us.com
http://www.ugg-bootsonline.us.com
http://www.air-jordanpascher.fr
http://www.outletmichaelkorsuk.co.uk
http://www.nikenfljerseysfreeshipping.us
http://www.north-face-outlet.in.net
http://www.moncler--paris.fr
http://www.coach-bags.us.org
http://www.nikeairmax.me.uk
http://www.cheap-jordans.us.com
http://www.airmaxnike.me.uk
http://www.uggoutletofficialsite.us.com
http://www.michael-korshandbagsoutlet.us.org
http://www.poloralphlaurenoutlet.org.uk
http://www.christianlouboutinoutletuk.org.uk
http://www.nikeairjordans.co.uk
http://www.nike-factoryoutlet.us.com
http://www.oakleysunglassess.us.org
http://www.michaeljordan-shoes.com
http://www.northfacethe.us.com
http://www.coachoutletonlineshopping.us.org
http://www.jacketmoncler.co.uk
http://www.tory-burch.org.uk
http://www.timberland.us.org
http://www.canadagooseoutlet-online.us.org
http://www.adidasshoessale.in.net
http://www.fitflopssaleclearance.us.org
http://www.prada.us.org
http://www.pandorajewelrycanada.ca
http://www.monclersitoufficiale.it
http://www.manoloblahnik.us
http://www.michaelkorsonline-outlet.us.com
http://www.truereligionsale.com.co
http://www.nikeukstore.org.uk
http://www.michaelkorsoutletonline80off.us.com
http://www.raybansunglassesoutlet.net.co
http://www.adidastore.co.uk
http://www.cheapmlbjerseysshop.us.com
http://www.originalsadidas.co.uk
http://www.blackhawksjersey.com
http://www.korsoutlet.us.com
http://www.coachfactory-outletstoreonline.us.com
http://www.ugg-outlets.com.co
http://www.nikefactory-outlet.us.com
http://www.monclernederland.nl
http://www.nikeairmaxshoes.us.com
http://www.tory-burchoutletonline.us.com
http://www.cheapairjordans.us.com
http://www.outlet-moncler.us
http://www.airjordanretro.fr
http://www.nikeairforce1.net
http://www.rayban.in.net
http://www.cheapnikenfljerseyswholesale.us
http://www.coachoutletsclearance.us.com
http://www.ray-bansunglassessales.us.com
http://www.katespadehandbagssale.us.org
http://www.monclerjassen.be
http://www.pandorajewelry-canada.ca
http://www.coachwallets.us.com
http://www.uggbootsclearance.net.co
http://www.coachoutletonline70off.us.com
http://www.outletlongchamp.us.org
http://www.converseshoesoutlet.us.com
http://www.louboutinoutlets.us.com
http://www.snapbackshatswholesale.us.com
http://www.ugg-australia.com.co
http://www.hermesoutlets.us.com
http://www.nikeoff.com
http://www.uggoutlet70off.us.com
http://www.ferragamoshoesoutlet.us.com
http://www.adidaswings.name
http://www.pradaoutletonlinestore.us.com
http://www.christianlouboutinsale.co.uk
201711.18wengdongdong




5. lzm00312/27/2017 01:18:38 AM


http://www.katespade-outletonline.com kate spade outlet online
http://www.pandora-bracelet.co pandora jewelry
http://www.tory-burch.net tory burch
http://www.jewelry-armoire.us Jewelry Armoire - Official
http://www.outlet-shop.us Wholesale Outlet Sale
http://www.Coach-Outlet.info coach outlet
http://www.burberryoutletw.com burberry outlet
http://www.katespadeoutletonline.org kate spade outlet online
http://www.coach-outlet-online.ca coach outlet online
http://www.katespadeoutlet.us kate spade outlet
http://www.jimmy-choo-shoes.us jimmy choo shoes
http://www.yeezy-boost350.us yeezy boots 350
http://www.boutique-cosmetique-bio.fr Nike Air Max Enfant
http://www.mizunoshop.us Wave Prophecy 2 Shoes
http://www.mlbshop.us.org shop mlb
http://www.oakley-outlet.us oakley outlet
http://www.chrome-store.us chrome store
http://www.nikeoutlet.co.uk nike outlet
http://www.outlet-michaelkors.org michael kors outlet
http://www.rayban-sunglasses-sale.us ray ban sunglasses sale
http://www.rayban-outlet.us Ray Ban sunglasses
http://www.chaussurespourfemme.fr Chaussures pour Femme
http://www.ray-ban-sunglasses.us ray-ban sunglasses
http://www.pradaoutletonline.net prada outlet sale
http://www.splaash.fr Nike Air Max Enfant
http://www.coach-outlet.us coach outlet
http://www.bookmarkvine.com Air Jordan 11 Femme
http://www.joebuy.com/womens-autumn-n-witer-clothing-c-38_173.html Wholesale womens autumn winter clothing
http://www.jimmychoouk.co.uk jimmy choo uk
http://www.coachoutletlove.us coach outlet
http://www.jimmychooshoesaustralia.net jimmy choo australia
http://www.runecheatz.com Nike Air Jordan Enfants
http://www.rayban-australia.com ray ban australia
http://www.coach-outlet.co.uk coach outlet
http://www.nikejordanpascher.fr Nike Air Max Femme
http://www.stsprepaid.com Nike Free Run
http://www.burberry-sale.com burberry sale
http://www.yeezyshoes.co yeezy shoes
http://www.bouldershoesewrepair.com boulder shoes sew repair
http://www.usito.fr Nike Air Max 1
http://www.coach--outlet.net coach outlet online
http://www.michael-korshandbags.com michael kors handbags
http://www.pumasneakers.ca puma sneakers
http://www.michaelkors-bags.info michael kors bags
http://www.coach-outlet.net.co coach outlet online
http://www.katespadeoutletsale.net kate spade outlet sale
http://www.ray-ban-outlet.us rayban sunglasses
http://www.culinar-hannover.de Air Max 90
http://www.raybanprescriptionglasses.us rayban prescription glasses
http://www.birkenstocksandals.net birkenstock sandals
http://www.canadagoose-outlet.org canada goose outlet
http://www.get-free-back-links.com backlink
http://www.outletsale.us burberry outlet sale
http://www.armanioutlet.org armani outlet
http://www.louisvuittonoriginal.com Louis Vuitton handbags
http://www.louis-vuitton-outlet.co louis vuitton outlet
http://www.coachoutletstore.ca coach outlet store
http://www.michael-kors--outlet.com michael kors outlet online
http://www.ugg.org.au ugg boots
http://www.coolraoul.fr Jordan Fusion Femme
http://www.nikeoutlet.net nike outlet
http://www.wedding--rings.us Wedding Rings- Official
http://www.rolex--watch.us rolex watch
http://www.pradaoutletonline.us prada outlet online
http://www.schuhe-infoblog.de Nike Air Max 2017
http://www.hermesoutlet.net hermes outlet
http://www.michaelkors-bags.net michael kors bags online
http://www.nikejordanshoes.us nike jordan shoes
http://www.pumashoes.us puma shoes
http://www.breitling-watches.us breitling watches
http://www.prada-outlet-online.com prada outlet online
http://www.clearanceoutlet.us/ clearance
http://www.school-bags.us school bags on sale
http://www.michael-kors-outlet.co michael kors outlet
http://www.pandora-australia.com pandora australia
http://www.oz-e-wahm.com Nike Air Force 1 Homme
http://www.nikefactoryoutlet.net nike factory outlet
http://www.rustyristine.com Nike Free Run
http://www.sp-lunettes.fr Lunette Oakley
http://www.conseil-invest.fr Nike Air Max Chase
http://www.blackfridaymichaelkors.us black friday michael kors
http://www.grandregency.fr Air Max Enfants
http://www.under-armour.ca under armour
http://www.burberry-factoryoutlet.com burberry factory outlet
http://www.burberry-outletstore.us burberry outlet
http://www.brighton-jewelry.us Brighton Jewelry - Official
http://www.brightonjewelry.us Brighton Jewelry - Official
http://www.katespadeoutlet1993.com kate spade outlet
http://www.va-bene-shoes.de Nike Air Max
http://www.chaussurespascheres.fr chaussure pas cher
http://www.pandora-bracelets.us pandora bracelets charms
http://www.pandora-bracelet-charms.us pandoracharms
http://www.katespadeoutletonline.net kate spade outlet online
http://www.handbags-online.us handbags online sale
http://www.raybanaustralia.com ray ban australia
http://www.michaelkorsoutlet.cc michael kors
http://www.gucci-watches.us gucci watches
http://www.michaelkorsbags.net.co michael kors bags
http://www.black-friday-deals.us black friday
http://www.katespadeoutletbags.com kate spade outlet bags
http://www.pandora-box.co.uk pandora jewelry uk
http://www.timberland-outlet.co.uk timberland outlet
http://www.michaelkorsfactoryoutlet.net michael kors factory outlet
http://www.premierjewelry.us Premier Jewelry - Official
http://www.greencleaned.net Green Cleaned
http://www.therca.org The Retail Compliance Association
http://www.eznara.com China wholesale
http://www.kate-spade-outlet-online.com kate spade outlet
http://www.cheapraybans.co cheap ray bans
http://www.puresoie.fr Nike Air Max 90
http://www.pandoraaustralia.com.au pandora australia
http://www.louisvuittonoutlet.co.uk louis vuitton outlet
http://www.raybanpolarized.us ray ban polarized
http://www.coach-outlet.com.co coach outlet online sale
http://www.nike-outlet.us nike running
http://www.nike-outlet-online.nl nike outlet online
http://www.versaceoutlet.org versace outlet
http://www.payless-shoes.org payless shoes online
http://www.stonesandbones.us Family Name Research
http://www.katespadeoutletsstore.us kate spade outlet store
http://www.spielen-roulette55.de Adidas Outlet
http://www.pandoraaustralia.net pandora australia
http://www.mode-damenschuhe.de mode damenschuhe
http://www.tory-burch.org tory burch
http://www.destiny-france.com Nike Air Jordan Enfants
lzm12.27




6. chenlina02/04/2018 09:27:00 PM


chenlina20180205
http://www.korsoutlet.us.org
http://www.christianlouboutinshoessale.org.uk
http://www.truereligionoutletjeans.us
http://www.uggslippers.org.uk
http://www.coachoutletsale.us.com
http://www.ralphlauren.in.net
http://www.jordan1.us
http://www.jordan5.us
http://www.jordanxx9.in.net
http://www.hermeskellybag.us.com
http://www.adidasjeremyscott.in.net
http://www.cheapnhljerseysshop.us.com
http://www.northfacethe.us.com
http://www.airmax.us.org
http://www.moncleroutletstore.us.com
http://www.airjordanretro.fr
http://www.poloralphoutlet.us.com
http://www.tory-burch.org.uk
http://www.canadagoose-jacket.me.uk
http://www.nikecortez.net
http://www.northfacejacket.us.com
http://www.coachfactoryoutlet-online.eu.com
http://www.uggstore.us.com
http://www.nikejordans.co.uk
http://www.redbottomsshoes.me.uk
http://www.cheapnfljerseysstore.us.com
http://www.uggsaustraliaboots.me.uk
http://www.ugg-boots.me.uk
http://www.nikemercurial.us
http://www.belstaffoutlet.us.com
http://www.cheapraybansunglass.co.uk
http://www.beatsheadphones.us.com
http://www.hermesbeltoutlet.com
http://www.uggscanadaboots.ca
http://www.airforce1.in.net
http://www.monclernederland.nl
http://www.mizuno.us.org
http://www.air-jordanpascher.fr
http://www.nikelunarglide.us
http://www.cheaprolexwatches.us.com
http://www.jerseys.us.org
http://www.sunglassesoakleycheap.us.com
http://www.ray-bansunglassessale.us.org
http://www.katespadehandbagssale.us.org
http://www.balenciaga.us.org
http://www.uggoutletinc.us.com
http://www.monclerjackenschweiz.ch
http://www.moncleroutlet.us.org
http://www.coachcom.us.com
http://www.airjordan11.us
http://www.nikerevolution.us
http://www.nikekyrie3.us.com
http://www.timberlandoutlet.org.uk
http://www.nikefootballbootsuk.org.uk
http://www.redbottomshoes.org.uk
http://www.canada-goosejassen.nl
http://www.bottesuggs.fr
http://www.nikeshox.in.net
http://www.moncler.eu.com
http://www.cheapnfljerseys.us.org
http://www.dansko.us.com
http://www.ugg.com.co
http://www.ralplaurenuk.org.uk
http://www.underarmouroutletclearance.com
http://www.niketrainers.org.uk
http://www.bcbg.us.com
http://www.birkenstocksandals.us.org
http://www.kevindurantshoes.us.com
http://www.uggbootscom.us.com
http://www.longchamp-handbags.us.org
http://www.poloralph.us.com
http://www.ralphlaurencom.us.com
http://www.hervelegerdresses.us.com
http://www.canadagoosecanada.ca
http://www.cheapmlbjersey.us.com
http://www.tods.us.com
http://www.baseballjersey.us.com
http://www.louboutin.in.net
http://www.bottega.in.net
http://www.truereligion-jeans.us
http://www.nikefree.net
http://www.canadagoosesale.com.co
http://www.chaussuresnikeairmax.fr
http://www.supremeclothing.us.com
http://www.coachfactoryoutletcom.us.com
http://www.montblanc.com.co
http://www.michaelkorsonline-outlet.us.com
http://www.nikefactory-outlet.us.com
http://www.shoecarnival.us.com
http://www.katespadehandbagsoutlet.us.org
http://www.coachfactoryoutlet-onlinestore.us.com
http://www.stuartweitzmanshoes.us.com
http://www.supremeparis.fr
http://www.northfacejackets.us.org
http://www.northfacejacketsclearance.us.com
http://www.newbalance.me.uk
http://www.adidasshoesoutletstore.us.com
http://www.uggaustralia.org.uk
http://www.ralph-laurenpolouk.org.uk
http://www.truereligionsale.com.co
http://www.nike-factoryoutlet.us.com
http://www.linksoflondonuk.me.uk
http://www.supreme-newyork.com
http://www.raybansunglassesoutlet.net.co
http://www.ralphlauren-outletstores.us.com
http://www.redbottoms.us.org
chenlina20180205




Enter Comments^


Email addresses provided are not made available on this site.





You can use UUB Code in your posts.

[b]bold[/b]  [i]italic[/i]  [u]underline[/u]  [s]strikethrough[/s]

URL's will be automatically converted to Links


:-x :cry: :laugh: :-( :cool: :huh: :-) :angry: :-D ;-) :-p :grin: :rolleyes: :-\ :emb: :lips: :-o
bold italic underline Strikethrough





Remember me    

Monthly Archive
Responses Elsewhere



About The Schwartz

rss.jpg


All opinions expressed here are my own, and do not represent positions of my employer.