CVE-2012-2174
published 2012-06-20CVE-2012-2174: The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
PriorityP265critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
38.29%
98.4th percentile
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
| ibm | lotus_notes | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect notes:// URI handler invocations originating from web browsers (IE, Chrome) that contain command-injection characters (e.g., '&', '%TEMP%') in the URL parameter. ↗
- →Alert on HTTP responses with Content-Type: application/octet-stream served from the same host that previously delivered a notes:// exploit page, as the module serves the payload EXE this way. ↗
- →Look for Meterpreter post-exploitation migration activity immediately after Notes client exploitation; the module sets InitialAutoRunScript to 'migrate -k -f' to migrate out of the Notes process. ↗
- →Detect short (2-character alpha) .exe and .js files dropped into %TEMP% in close temporal proximity, as the exploit stages a randomly named JS downloader and EXE payload there. ↗
- ·The exploit module supports optional JavaScript obfuscation (OBFUSCATE option), meaning the delivered HTML page may use obfuscated JS to trigger the notes:// link click, reducing the reliability of static JS-pattern detection. ↗
- ·The module uses a MouseEvent-based programmatic link click to trigger the notes:// handler, bypassing the need for user interaction; detections relying on user-initiated protocol handler invocation will miss this. ↗
- ·The payload space is constrained to 2048 bytes with a stack adjustment of -3500; shellcode exceeding this size will not work, limiting the payload types usable in-the-wild with this vector. ↗
- ·EXITFUNC is set to 'none', meaning the exploited process will likely crash after payload execution; process-crash telemetry for the Notes client following a browser-initiated notes:// call is a strong indicator of exploitation. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM Lotus Notes Client URL Handler - Command Injection (Metasploit)
exploitdb·2012-12-25
CVE-2012-2174 IBM Lotus Notes Client URL Handler - Command Injection (Metasploit)
IBM Lotus Notes Client URL Handler - Command Injection (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 "IBM Lotus Notes Client URL Handler Command Injection",
'Description' => %q{
This modules exploits a command injection vulnerability in the URL handler for
for the IBM Lotus Notes Client MSF_LICENSE,
'Author' =>
[
'Moritz Jodeit', # Vulnerability discovery
'Sean de Regge', # Vulnerability analysis
'juan vazquez' # Metasploit
],
'References' =>
[
[ 'CVE', '2012-2174' ],
[ 'OSVDB', '83063' ],
[ 'BID', '54070' ],
[ 'URL', 'http://
Metasploit
IBM Lotus Notes Client URL Handler Command Injection
metasploit
IBM Lotus Notes Client URL Handler Command Injection
IBM Lotus Notes Client URL Handler Command Injection
This module exploits a command injection vulnerability in the URL handler for for the IBM Lotus Notes Client <= 8.5.3. The registered handler can be abused with a specially crafted notes:// URL to execute arbitrary commands with also arbitrary arguments. This module has been tested successfully on Windows XP SP3 with IE8, Google Chrome 23.0.1271.97 m and IBM Lotus Notes Client 8.5.2.
No writeups or analysis indexed.
2012-06-20
Published