CVE-2023-32315

Name of the Vulnerable Software and Affected Versions Openfire versions 3.10.0 through 4.6.7 Openfire versions 4.7.0 through 4.7.4

Description The administrative console of Openfire, a web-based application, is susceptible to a path traversal attack via the setup environment. This occurs because path traversal protections did not account for non-standard URL encoding of UTF-16 characters supported by the embedded webserver. By combining this with wildcard pattern matching in the API's authentication exclusion mechanism, an unauthenticated user can access restricted administrative pages. This flaw has been exploited in the wild by Kinsing malware and other attackers to create unauthorized administrator accounts, install malicious Java plugins (JAR files) to execute shell commands via GET and POST requests, and deploy cryptominers or backdoors. Over 3,000 servers were reported as vulnerable. The issue can be tested by accessing the endpoint '/setup/setup-s/%u002e%u002e/%u002e%u002e/log.jsp'.

Recommendations Upgrade to version 4.6.8, 4.7.5, or 4.8.0. Restrict network access to the Admin Console using firewalls or ACLs to ensure it is not exposed to the general internet, specifically restricting ports 9090 and 9091. Modify the plugins/admin/webapp/WEB-INF/web.xml file by removing all asterisk (*) characters from the param-value of the AuthCheck filter. Bind the admin console to the loopback interface by adding the <interface>127.0.0.1</interface> element to the <adminConsole> section in the conf/openfire.xml file. Install the AuthFilterSanitizer plugin to periodically remove entries susceptible to abuse. Update the Random Avatar plugin to version 1.1.0 or later, the Monitoring Service plugin to version 2.5.0 or later, and the HTTP File Upload plugin to version 1.3.0 or later.