CVE-2020-14273
📋 TL;DR
HCL Domino has a Denial of Service vulnerability in its public API due to improper input validation. Unauthenticated attackers can send specially crafted requests to crash the Domino server, affecting all systems running vulnerable versions of HCL Domino.
💻 Affected Systems
- HCL Domino
📦 What is this software?
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
Domino by Hcltech
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash leading to sustained service unavailability for all Domino services and applications.
Likely Case
Temporary service disruption requiring server restart, potentially causing data loss or corruption in active transactions.
If Mitigated
Minimal impact with proper network segmentation and API access controls limiting exposure.
🎯 Exploit Status
Simple HTTP request manipulation required. No authentication needed to trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.1 FP5 or 12.0.0
Vendor Advisory: https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085947
Restart Required: Yes
Instructions:
1. Download the appropriate fix pack from HCL Support. 2. Apply the fix pack following HCL Domino upgrade procedures. 3. Restart the Domino server to activate the patch.
🔧 Temporary Workarounds
Restrict API Access
allLimit access to Domino public API endpoints using firewall rules or network segmentation.
Disable HTTP Task
allTemporarily disable the Domino HTTP task if not required for essential services.
Tell HTTP quit
🧯 If You Can't Patch
- Implement strict network ACLs to limit access to Domino API endpoints to trusted sources only.
- Deploy web application firewall (WAF) with rules to detect and block malformed API requests.
🔍 How to Verify
Check if Vulnerable:
Check Domino version using 'show server' command and compare against vulnerable versions (pre-11.0.1 FP5 or pre-12.0.0).Check Version:
show serverVerify Fix Applied:
Verify Domino version is 11.0.1 FP5 or higher, or 12.0.0 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Unexpected server crashes
- HTTP task termination errors
- Abnormal API request patterns
Network Indicators:
- Multiple malformed HTTP requests to Domino API endpoints from single source
- Spike in HTTP error responses
SIEM Query:
source="domino.log" AND ("crash" OR "abnormal termination" OR "HTTP task")