Lotus Domino Allows Directory Traversal

Reported January 5, 2001by Georgi Guninski

VERSIONS AFFECTED

DESCRIPTION

LotusDomino Server lets remote users gain access to files not typically availablethrough the server.

DEMONSTRATION

Byinserting an .nfs extension into the URL after the server name, remote users can specify a filename for viewing, provided they know theliteral path to the file:

http://localhost/.nsf/../winnt/win.ini

VENDORRESPONSE

IBMhas been informed of the problem and will correct the matter in the next versionof Domino Server. In the meantime, users can work around the problem by creatinga URL redirection or mapping within the Domino Server administrative client, andby isolating the Domino Server installation on its own partition.

UPDATE 01/18/2001: According to a response posted on the Lotus Web site, this issue will be corrected in version 5.0.6a.

CREDIT
Discovered by Georgi Guninski