Thousands of Openfire servers are vulnerable to CVE-2023-32315, an actively exploited and path traversal vulnerability that allows an unauthenticated user to create new admin accounts.
Openfire is a widely used Java-based open-source chat (XMPP) server with over 9 million downloads.
On May 23, 2023, it was disclosed that the software was impacted by an authentication bypass issue that affected version 3.10.0, released in April 2015, until that point.
Openfire developers released security updates in versions 4.6.8, 4.7.5, and 4.8.0 to address the issue. However, in June, it was reported that the flaw was actively exploited to create admin users and upload malicious plugins on unpatched servers.
According to a report by VulnCheck vulnerability researcher Jacob Baines, the OpenFire community has not rushed to apply the security updates, with over 3,000 servers remaining vulnerable.
Baines says it is possible to exploit the flaw and upload plugins without creating an admin account, making it easier for cybercriminals.
VulnCheck reports that Shodan scans reveal 6,324 internet-facing Openfire servers, of which 50% (3,162 servers) still remain vulnerable to CVE-2023-32315 due to running an outdated version.
Only 20% of users have patched, 25% use a version older than 3.10.0, which is when the vulnerability was introduced to the software, and another 5% run forks of the open-source project that may or may not be impacted.
Current public exploits for CVE-2023-32315 rely on creating an admin user to allow the attackers to upload malicious Java JAR plugins that open reverse shells or execute commands on the compromised servers.
VulnCheck’s report highlights a stealthier way to exploit the flaw without creating random admin accounts. In their PoC example, the analysts showcase a way to extract the JSESSIONID and CSRF token by accessing ‘plugin-admin.jsp’ directly and then uploading the JAR plugin via a POST request.
The plugin is accepted and installed on the vulnerable server, and its webshell can be accessed without requiring an admin account.
This attack does not leave traces in the security logs and so eliminates detection opportunities for defenders.
As CVE-2023-32315 is already under active exploitation, including from a botnet malware, VulnCheck’s PoC could fuel a second attack wave that’s more formidable.
The admins of Openfire servers who have not upgraded to a patched release are recommended to do so as soon as possible.
Comments