CVE-2023-37535
📋 TL;DR
This vulnerability allows attackers to inject malicious scripts through query parameters in HCL Domino Volt and Domino Leap applications due to insufficient URI protocol whitelisting. It enables cross-site scripting (XSS) attacks that can steal user credentials, session tokens, or perform actions on behalf of users. Organizations using affected versions of these HCL collaboration platforms are at risk.
💻 Affected Systems
- HCL Domino Volt
- HCL Domino Leap
📦 What is this software?
Domino Leap by Hcltech
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, compromise user accounts, exfiltrate sensitive data, or perform unauthorized actions within the application on behalf of authenticated users.
Likely Case
Attackers inject malicious scripts to steal user session cookies or credentials, potentially leading to account takeover and unauthorized access to sensitive information.
If Mitigated
With proper input validation and output encoding, the impact is limited to potential script execution in specific contexts, but user data remains protected.
🎯 Exploit Status
Exploitation requires the attacker to craft malicious URLs with script payloads in query parameters and trick users into visiting them.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.0.1.6
Vendor Advisory: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
Restart Required: Yes
Instructions:
1. Download HCL Domino Volt/Domino Leap version 1.0.1.6 or later from HCL support portal. 2. Backup current installation and data. 3. Stop the application services. 4. Apply the update following vendor instructions. 5. Restart services and verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize query parameters and reject malicious script content
Content Security Policy
allImplement strict CSP headers to prevent script execution from untrusted sources
Content-Security-Policy: default-src 'self'; script-src 'self'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious query parameters containing script tags and JavaScript
- Enable strict output encoding for all user-controlled data displayed in web interfaces
🔍 How to Verify
Check if Vulnerable:
Check application version via admin console or configuration files. Versions below 1.0.1.6 are vulnerable.Check Version:
Check application.properties or admin interface for version informationVerify Fix Applied:
After patching, verify version shows 1.0.1.6 or higher and test query parameter handling with safe test payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual query parameters containing script tags or JavaScript code
- Multiple failed attempts with encoded payloads in URLs
Network Indicators:
- HTTP requests with suspicious query parameters containing script elements
- Outbound connections to unknown domains following script execution
SIEM Query:
source="web_server" AND (uri_query="*<script*" OR uri_query="*javascript:*")