Directory traversal vulnerability in log.jsp in Ignite Realtime Openfire 3.6.2 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the log parameter.

The remote host is affected by the vulnerability described in GLSA-200904-01 (Openfire: Multiple vulnerabilities)

    Two vulnerabilities have been reported by Federico Muttis, from CORE     IMPACT's Exploit Writing Team:
    Multiple missing or incomplete input validations in several .jsps     (CVE-2009-0496).
    Incorrect input validation of the 'log' parameter in log.jsp     (CVE-2009-0497).
    Multiple vulnerabilities have been reported by Andreas Kurtz:
    Erroneous built-in exceptions to input validation in login.jsp     (CVE-2008-6508).
    Unsanitized user input to the 'type' parameter in     sipark-log-summary.jsp used in SQL statement. (CVE-2008-6509)     A Cross-Site-Scripting vulnerability due to unsanitized input to the     'url' parameter. (CVE-2008-6510, CVE-2008-6511)   Impact :

    A remote attacker could execute arbitrary code on clients' systems by     uploading a specially crafted plugin, bypassing authentication.
    Additionally, an attacker could read arbitrary files on the server or     execute arbitrary SQL statements. Depending on the server's     configuration the attacker might also execute code on the server via an     SQL injection.
  Workaround :

    There is no known workaround at this time.

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.  According to its version, the installation of Openfire or Wildfire is affected by multiple vulnerabilities : 

  - Multiple .jsp scripts namely, 'logviewer.jsp' (BID 32935), 'group-summary.jsp' (BID 32937), 'user-properties.jsp' (BID 32938), 'audit-policy.jsp' (BID 32939) and 'log.jsp' (BID 32940) fail to sanitize input supplied by authorized users, and hence are affected by cross-site scripting vulnerabilities.

  - Provided an administrator's browser session is allowed to execute arbitrary JavaScript and an attacker has managed to steal session cookies, it may be possible for an attacker to execute arbitrary code on the remote system by uploading a new server plugin.

  - Pages 'security-audit-viewer.jsp', 'server-properties.js' (BID 32943) and 'muc-room-summary.jsp' (BID 32944) are affected by a stored cross-site scripting vulnerabilities. (BID 32943)

  - log.jsp fails to sanitize input passed to the 'log' parameter by an authorized user, and hence it may be possible for an authenticated attacker to read arbitrary .log files. (BID 32945).

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.

According to its version, the installation of Openfire or Wildfire is affected by multiple vulnerabilities :

  - Multiple .jsp scripts namely, 'logviewer.jsp'     (BID 32935), 'group-summary.jsp' (BID 32937),     'user-properties.jsp' (BID 32938), 'audit-policy.jsp'     (BID 32939) and 'log.jsp' (BID 32940) fail to sanitize     input supplied by authorized users, and hence are     affected by cross-site scripting vulnerabilities.

  - Provided an administrator's browser session is allowed     to execute arbitrary Javascript and an attacker has     managed to steal session cookies, it may be possible     for an attacker to execute arbitrary code on the remote     system by uploading a new server plugin.

  - Pages 'security-audit-viewer.jsp',     'server-properties.js'     (BID 32943) and 'muc-room-summary.jsp' (BID 32944) are     affected by a stored cross-site scripting     vulnerabilities. (BID 32943)

  - log.jsp fails to sanitize input passed to the 'log'     parameter by an authorized user, and hence it may be     possible for an authenticated attacker to read arbitrary     .log files. (BID 32945)

Core Security Technologies reports :

Multiple cross-site scripting vulnerabilities have been found which may lead to arbitrary remote code execution on the server running the application due to unauthorized upload of Java plugin code.

ID	Name	Product	Family	Severity
36078	GLSA-200904-01 : Openfire: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
4925	Openfire < 3.6.3 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
35628	Openfire < 3.6.3 Multiple Vulnerabilities	Nessus	CGI abuses	medium
35458	FreeBSD : openfire -- multiple vulnerabilities (c3aba586-ea77-11dd-9d1e-000bcdc1757a)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2009-0497

high

Tenable Plugins

high

high

medium

medium