Openfire AuthCheck Authentication Bypass

high Nessus Plugin ID 34725

Language:

Synopsis

The remote web server contains an application that is affected by an authentication bypass vulnerability.

Description

The remote host is running Openfire / Wildfire, an instant messaging server supporting the XMPP protocol.

The installed version of this software contains a design error in its admin interface in that it allows URLs starting with certain strings, such as 'setup/setup-', to circumvent its auth check mechanism. A remote attacker can leverage this issue to bypass authentication and gain administrative access to the application.

Based on the presence of this vulnerability, it is likely that the admin interface in the installed version is also affected by multiple cross-site scripting issues as well as a SQL injection vulnerability that allows an attacker to write files to disk and execute code at the operating system level. Nessus has not, though, checked for these other issues.

Solution

Upgrade to Openfire 3.6.1 or later.

Plugin Details

Severity: High

ID: 34725

File Name: openfire_3_6_0a_auth_bypass.nasl

Version: 1.19

Type: remote

Family: CGI abuses

Published: 11/9/2008

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:igniterealtime:openfire

Exploit Ease: No exploit is required

Exploited by Nessus: true

Exploitable With

Metasploit (Openfire Admin Console Authentication Bypass)

Reference Information

CVE: CVE-2008-6508

BID: 32189

CWE: 22

Secunia: 32478

Detections

Analytics