CVE-2024-30146
📋 TL;DR
This vulnerability allows certain administrative users in HCL Domino Leap to import applications from the server's filesystem due to improper access control. It affects HCL Domino Leap installations where administrative users have access to vulnerable endpoints. The impact is limited to authorized admin users but could lead to unauthorized application deployment.
💻 Affected Systems
- HCL Domino Leap
📦 What is this software?
Domino Leap by Hcltech
⚠️ Risk & Real-World Impact
Worst Case
An authenticated admin user could import malicious applications from the server filesystem, potentially leading to code execution, data exposure, or server compromise.
Likely Case
Authorized admin users could inadvertently or intentionally import applications they shouldn't have access to, leading to unauthorized application deployment or configuration changes.
If Mitigated
With proper access controls and monitoring, impact is limited to authorized administrative actions within expected boundaries.
🎯 Exploit Status
Exploitation requires authenticated administrative access to the Domino Leap interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.18
Vendor Advisory: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120722
Restart Required: Yes
Instructions:
1. Download HCL Domino Leap 1.0.18 from HCL support portal. 2. Backup current installation. 3. Apply the update following HCL's upgrade documentation. 4. Restart the Domino Leap service.
🔧 Temporary Workarounds
Restrict administrative access
allLimit administrative access to only trusted users who require application import capabilities
Monitor application import activity
allImplement logging and monitoring for application import operations
🧯 If You Can't Patch
- Implement strict access controls and review administrative user permissions
- Enable detailed logging of all application import operations and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Domino Leap version via administrative interface or configuration files. Versions below 1.0.18 are vulnerable.Check Version:
Check version in Domino Leap administrative console or review installation directory version filesVerify Fix Applied:
Verify version is 1.0.18 or higher in administrative interface or configuration📡 Detection & Monitoring
Log Indicators:
- Unusual application import activity
- Multiple import attempts from same admin user
- Imports from unexpected file system locations
Network Indicators:
- HTTP POST requests to application import endpoints from admin users
SIEM Query:
source="domino_leap" AND (event="application_import" OR endpoint="/api/import")