title: How to avoid a XSP/Domino Cross-Site Scripting Vulnerability?
body: <p>It seems possible to inject javascript in a get request, when refering to the /xsp/.ibmmodres/ XSP/Domino resources.</p>
  
  <p>Normally, when you try this at .nsf/  resources, you get a correct default or custom errorpage without XSS possibilities. Special characters are substituted.</p>
  
  <p>Example: 
   - http://[server]/[path]/[dbname].nsf/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E</p>
  
  <p>Result:
  HTTP Web Server: Cannot find design element</p>
  
  <p>But refering to the /xsp/.ibmmodres/ resources, it yields XSS possibilities.</p>
  
  <p>Example:</p>
  
  <ul>
  <li>http://[server]/[path]/[dbname].nsf/xsp/.ibmmodres/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E</li>
  </ul>
  
  <p>Result: </p>
  
  <ul>
  <li><p>I get a 404 errorpage "Cannot load unregistered resource /"</p></li>
  <li><p>And it executes CSJS and shows for example DomAuthSessID !!</p></li>
  </ul>
  
  <p>How is this possible?
  Is there a way to avoid this?
  Please help!</p>