documentation technical

technology software

English

_dss

SERVERID

JSESSIONID

_dsu

TC_PRIVACY

Within the commercial generic top-level domain (.com), 'eu1-ds-iam.3dexperience.3ds.com' is registered; it also runs on subdomain 'eu1-ds-iam.3dexperience'. Count 3 characters in '3ds' containing zero vowels alongside 2 consonants, notching one digit. Segmentation suggests two words: 3, ds. Expect 1.5 characters per word on average. No strong language cues emerged from the frequency lists.

username

html/84/33/84339320-d71e-4de4-af3d-2767e5bbb149.html.gz

multipart/form-data; boundary=----WebKitFormBoundaryUvzygYrfBdC4ahKA

4b41a3ccde6dba63310040e419bbc9ce332eef91cd42f6a2847012d5ce77a09e

16fa7c18c4c2beb5dd08d2e6f397e096af9787edd766ad4aff38cf2e2c8444ef

a8306cef3584b82dc064d4b89dd8f54533bc72195f2a6a497640e63bd5847fa2

8489c85d4ef8fd550e1c9f1bf4ba44a637642b6522f35d1a633b54f5590454f5

f8edc89efe500e055879b92ed92b4131ee038ba8b302a814a071d987650d63dc

0220bf8dbd1e33645896514f8f157f13ec94897eac5c3aefdbfb00cf64c0cfb5

7e94ec5b8bb6cec8b13ac3457924b4d857397ed759d651f3cf1dee4f06c5fcbc

1c6255bb96579c402a0a6eee4b197292a1b83a61b68455481a724e2559c9ad39

2ab1f1171f6fe4781fe3b9a38ebec5207836c3f9dd289d2c64f393a71dd97d13

911036ff1e1ab303c6e55f58ee4de61e50486218f6592d9dc73f41689bbccd63

1d273831634cb9f585563790796fba72bac17d688ba2fc166f517cc6b4a35d5e

A prototype pollution vulnerability in handlebars is exploitable if an attacker can control the template

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:  
```{{#with "constructor"}}
	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting)

Disallow calling helperMissing and blockHelperMissing directly

Quoteless attributes in templates can lead to XSS

Remote code execution in handlebars when compiling templates

81d843c3d7a5dfd35f599dc991c31260159b38ec067cd416ada4f2ca080c9bd5

98613fe08371ad0757e40172d450b1caba91e519bd3f1e2873db5c4dbf0d54a5

width=device-width, initial-scale=1, user-scalable=1

viewport

application-name

The 3DEXPERIENCE (3DX) platform brings together all aspects of your business in a single platform to increase collaboration, improve execution and accelerate innovation

description

robots

theme-color

apple-mobile-web-app-title

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

SafeBrands SAS

3DS.COM

Abuse OUTSCALE

Laurent Seror

MNT-OUTSCALE

Outscale SASU

ORG-NCC1-RIPE

NOC OUTSCALE

FR-OUTSCALE-20120629


        var UWA;
        dsDefaultWebappsBaseUrl= "/3DPassport/resources-260422142835/js/";
        requirejs.config({
            baseUrl: "/3DPassport/resources-260422142835/js/",
            paths: {
                "DS/W3DPassport/dsp/config": "empty:",
                "UWA": "libs/UWA2/js",
                "DS/UIKIT": "libs/UIKIT",
                "DS/GDPR": "libs/GDPR",
                "DS/Handlebars": "libs/Handlebars",
                "DS/VENHandlebars": "libs/VENHandlebars",
                "DS/W3DXComponents": "libs/W3DXComponents",
                "DS/WebAppsFoundations": "libs/WebAppsFoundations",
                "DS/VENHammer": "libs/VENHammer/1.0.1/hammer",
                "DS/CefCommunication" : "libs/CefCommunication",
                "DS/W3DPassport": "DS/W3DPassport",
                "DS/Usage": "libs/Usage",
                "DS/WebappsUtils" : "libs/WebappsUtils",
                "recaptcha": "https://www.google.com/recaptcha/api"
            }
        });
        define("DS/W3DPassport/dsp/config/login", [], function () {
            var configData = JSON.parse(document.getElementById("configData").innerHTML);
            configData.csrfTokenValue = "";
            configData.csrfTokenName = "";
            configData.pageId = "login";
            configData.resourceUrl = "/3DPassport/resources-260422142835";
            return configData;
        });
        require(["DS/W3DPassport/dsp/DSP"], function () {
            require(["DS/W3DPassport/login"]);
        });
    

Requests	IP Address	Location	AS Autonomous System
7	171.33.102.140	Paris, Île-de-France, France	AS50624Outscale SASU
4	171.33.93.14	Paris, Île-de-France, France	AS50624Outscale SASU
4	148.253.111.140	France	AS50624Outscale SASU
4	171.33.100.36	Paris, Île-de-France, France	AS50624Outscale SASU
4	171.33.111.116	Paris, Île-de-France, France	AS50624Outscale SASU
4	142.44.41.32	Canada	AS50624Outscale SASU
27	6	-	-

Security Scan Report: eu1-ds-iam.3dexperience.3ds.com

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History