Re: IBM Lotus Notes/Domino fails to encode Square Brackets ( [ ]

[Juan C Calderon]

In-Reply-To: <20041018184817.32681.qmail@www.securityfocus.com>

Regarding the Trivial example I sent:

>>http://www.SomeLotusSite.com/FormReflectingURLValue?OpenForm&Field=[&lt;script&gt;.....&lt;/script&gt;]

Please replace &lt; with "Less Than" character and &gt; with "greater than" character for this to work, looks like those characters where doble encoded (for obvious security reasons) when posted.

Here is the URL encoded version as well:
http://www.SomeLotusSite.com/FormReflectingURLValue?OpenForm&Field=%5B%3Cscript%3E%2E%2E%2E%2E%2E%3C%2Fscript%3 E%5D

&lt; Regards

[Juan C Calderon]

In-Reply-To: <20041018184817.32681.qmail@www.securityfocus.com>

We are aware that at least from R4 and later versions embedded HTML code enclosed in square brackets is send "as is" to browser, we tested this issue in R6 and R5 environments and it worked, it should work in all prior versions that support this feature.


Additional testing has being performed on this issue, please see our findings below:

1)An Agent that modify computed field values can transmit/inject the exploit to them.
2) <High Risk> We entered the exploit in an editable field, save the document and when we see the document in read mode, it worked!.

The latest test shows how critical can this problem be.

The essence of the problem remains, sending a XSS attack by making Notes/Domino to "honor" the code enclosed in square brackets avoiding native HTML encoding.

Best Regards