HCL Sametime is vulnerable to arbitrary HTTP requests

HCL Sametime's FaviconService accepts a base64-encoded URL and fetches it from the server, allowing attackers to make arbitrary HTTP requests to internal or external systems by manipulating the URL parameter passed through the meetings function.

The FaviconService endpoint accepts base64-encoded URLs that are server-side requested without proper validation, enabling SSRF (Server-Side Request Forgery) attacks. An authenticated attacker can craft malicious URLs through the meetings function to access internal resources, bypass firewalls, or probe internal network infrastructure.