Ignite Realtime · Openfire
Openfire, the XMPP server from Ignite Realtime, contains a path traversal flaw in its administrative console's setup environment, which is web-based. An unauthenticated remote attacker, with no user interaction required, can use the unauthenticated setup environment on an already configured server to reach restricted administrative pages in the Admin Console.
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.
First seen exploited 14 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
6 fixes in xmppserver over 6 years. The latest fix listed for xmppserver is 5.0.2.
CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.igniterealtime.openfire:xmppserver.
Upgrade to 4.7.5 or later
Set the version to 4.7.5 or later in your pom.xml or build.gradle.
The first fix for CVE-2023-32315. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 4.7.0 up to 4.7.5 | 4.7.5 |
| 3.10.0 up to 4.6.8 | 4.6.8 |
“Up to” means the second version is the fix and is not affected.
Reports are matched by finding the exact id CVE-2023-32315 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Update (8/27/23) – Aqua Nautilus discovered a new campaign that exploits the Openfire vulnerability (CVE-2023-32315 to deploy Kinsing malware and a cryptominer.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
