Vulnerabilities > CVE-2012-2174 - Code Injection vulnerability in IBM Lotus Notes
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Exploit-Db
description | IBM Lotus Notes Client URL Handler Command Injection. CVE-2012-2174. Remote exploit for windows platform |
id | EDB-ID:23650 |
last seen | 2016-02-02 |
modified | 2012-12-25 |
published | 2012-12-25 |
reporter | metasploit |
source | https://www.exploit-db.com/download/23650/ |
title | IBM Lotus Notes Client URL Handler Command Injection |
Metasploit
description | This module exploits a command injection vulnerability in the URL handler for for the IBM Lotus Notes Client <= 8.5.3. The registered handler can be abused with a specially crafted notes:// URL to execute arbitrary commands with also arbitrary arguments. This module has been tested successfully on Windows XP SP3 with IE8, Google Chrome 23.0.1271.97 m and IBM Lotus Notes Client 8.5.2. |
id | MSF:EXPLOIT/WINDOWS/BROWSER/NOTES_HANDLER_CMDINJECT |
last seen | 2020-06-07 |
modified | 2017-10-05 |
published | 2012-12-24 |
references | |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/browser/notes_handler_cmdinject.rb |
title | IBM Lotus Notes Client URL Handler Command Injection |
Nessus
NASL family | Windows |
NASL id | LOTUS_NOTES_8_5_3_FP2.NASL |
description | The remote host has a version of Lotus Notes prior to 8.5.3 Fix Pack 2 installed. It is, therefore, reportedly affected by a remote code execution vulnerability that an attacker can exploit by tricking a victim into clicking a specially crafted |
last seen | 2020-06-01 |
modified | 2020-06-02 |
plugin id | 61487 |
published | 2012-08-10 |
reporter | This script is Copyright (C) 2012-2018 Tenable Network Security, Inc. |
source | https://www.tenable.com/plugins/nessus/61487 |
title | IBM Lotus Notes < 8.5.3 FP2 URL Handler Unspecified Remote Code Execution |
Packetstorm
data source | https://packetstormsecurity.com/files/download/119058/notes_handler_cmdinject.rb.txt |
id | PACKETSTORM:119058 |
last seen | 2016-12-05 |
published | 2012-12-24 |
reporter | Moritz Jodeit |
source | https://packetstormsecurity.com/files/119058/IBM-Lotus-Notes-Client-URL-Handler-Command-Injection.html |
title | IBM Lotus Notes Client URL Handler Command Injection |
Saint
bid | 54070 |
description | IBM Lotus Notes URL Handler Command Execution |
id | mail_client_notesfilever |
osvdb | 83063 |
title | lotus_notes_url_handler |
type | client |
Seebug
bulletinFamily | exploit |
description | CVE ID: CVE-2012-2174 IBM Lotus Notes是桌面客户端,为用户提供了单点访问功能,有助于他们创建、查询和共享知识,与团队协作,以及采取相应措施。 IBM Lotus Notes 8.0.2、8.5、8.5.1、8.5.2、8.5.3在"notes" URI处理程序中存在错误,可被利用执行任意命令。 0 IBM Lotus Notes 8.x 厂商补丁: IBM --- IBM已经为此发布了一个安全公告(1598348)以及相应补丁: 1598348:Security Bulletin: IBM Lotus Notes URL Command Injection Remote Code Execution Vulnerability (CVE-2012-2174) 链接:http://www-304.ibm.com/support/docview.wss?uid=swg21598348 |
id | SSV:60226 |
last seen | 2017-11-19 |
modified | 2012-06-23 |
published | 2012-06-23 |
reporter | Root |
title | IBM Lotus Notes 8.x "notes" URI处理器漏洞 |