Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows remote attackers to bypass authentication and access the admin interface via a .. (dot dot) in a URI that matches the Exclude-Strings list, as demonstrated by a /setup/setup-/.. sequence in a URI.

The remote host is affected by the vulnerability described in GLSA-200904-01 (Openfire: Multiple vulnerabilities)

    Two vulnerabilities have been reported by Federico Muttis, from CORE     IMPACT's Exploit Writing Team:
    Multiple missing or incomplete input validations in several .jsps     (CVE-2009-0496).
    Incorrect input validation of the 'log' parameter in log.jsp     (CVE-2009-0497).
    Multiple vulnerabilities have been reported by Andreas Kurtz:
    Erroneous built-in exceptions to input validation in login.jsp     (CVE-2008-6508).
    Unsanitized user input to the 'type' parameter in     sipark-log-summary.jsp used in SQL statement. (CVE-2008-6509)     A Cross-Site-Scripting vulnerability due to unsanitized input to the     'url' parameter. (CVE-2008-6510, CVE-2008-6511)   Impact :

    A remote attacker could execute arbitrary code on clients' systems by     uploading a specially crafted plugin, bypassing authentication.
    Additionally, an attacker could read arbitrary files on the server or     execute arbitrary SQL statements. Depending on the server's     configuration the attacker might also execute code on the server via an     SQL injection.
  Workaround :

    There is no known workaround at this time.

Andreas Kurtz reports :

The jabber server Openfire (<= version 3.6.0a) contains several serious vulnerabilities. Depending on the particular runtime environment these issues can potentially even be used by an attacker to execute code on operating system level.

- Authentication bypass - This vulnerability provides an attacker full access to all functions in the admin webinterface without providing any user credentials. The Tomcat filter which is responsible for authentication could be completely circumvented.

- SQL injection - It is possible to pass SQL statements to the backend database through a SQL injection vulnerability. Depending on the particular runtime environment and database permissions it is even possible to write files to disk and execute code on operating system level.

- Multiple Cross-Site Scripting - Permits arbitrary insertion of HTML- and JavaScript code in login.jsp. An attacker could also manipulate a parameter to specify a destination to which a user will be forwarded to after successful authentication.

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol. 

The installed version of this software contains a design error in its admin interface in that it allows URLs starting with certain strings, such as 'setup/setup-', to circumvent its auth check mechanism.  A remote attacker can leverage this issue to bypass authentication and gain administrative access to the application. 

Based on the presence of this vulnerability, it is likely that the admin interface in the installed version is also affected by multiple cross-site scripting issues as well as a SQL injection vulnerability that allows an attacker to write files to disk and execute code at the operating system level.  Nessus has not, though, checked for these other issues.

ID	Name	Product	Family	Severity
36078	GLSA-200904-01 : Openfire: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
34839	FreeBSD : openfire -- multiple vulnerabilities (937adf01-b64a-11dd-a55e-00163e000016)	Nessus	FreeBSD Local Security Checks	high
34725	Openfire AuthCheck Authentication Bypass	Nessus	CGI abuses	high

Detections

Analytics

CVE-2008-6508

critical

Tenable Plugins

high

high

high