Openfire administration console authentication bypass
Affects Openfire 3.10.0 through 4.7.4 on already configured installs, where the unauthenticated setup environment is reachable. Fixed in 4.6.8 and 4.7.5.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 4.6.8, 4.7.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Openfire, an open-source XMPP (instant messaging) server, is affected, including its web-based administration console. An unauthenticated attacker can exploit a path traversal flaw in the setup environment to reach restricted administrative pages, potentially gaining full administrative control over the server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- igniterealtime Openfire
From 3.10.0 · fixed in 4.6.8; From 4.7.0 · fixed in 4.7.5
- org.igniterealtime.openfire:xmppserverMaven
From 3.10.0 · fixed in 4.6.8
- org.igniterealtime.openfire:xmppserverMaven
From 4.7.0 · fixed in 4.7.5
References 2
GitHub · igniterealtime/Openfire
packetstormsecurity.com
Questions about CVE-2023-32315
What does this mean?
A flaw in the Openfire administration console lets an unauthenticated attacker bypass authentication and reach restricted Admin Console pages that are reserved for administrative users.Source: github.com
Am I affected, and how do I check?
All Openfire versions from 3.10.0 onward are affected until they are fixed, which means 3.10.0 through 4.6.7 and 4.7.0 through 4.7.4. The issue concerns already configured installations, where the unauthenticated Setup Environment is reachable. To check, compare the installed Openfire version number against these ranges.Source: github.com
What should I do about it?
Upgrade to Openfire 4.6.8 or 4.7.5, depending on which release line you run. The advisory states that both releases contain the patch.Source: github.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-08-24, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data