116 lines
No EOL
2.1 KiB
Text
116 lines
No EOL
2.1 KiB
Text
[+] Credits: hyp3rlinx
|
|
|
|
[+] Website: hyp3rlinx.altervista.org
|
|
|
|
[+] Source:
|
|
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-FILE-UPLOAD.txt
|
|
|
|
|
|
|
|
Vendor:
|
|
=========================================
|
|
www.igniterealtime.org/projects/openfire
|
|
www.igniterealtime.org/downloads/index.jsp
|
|
|
|
|
|
|
|
Product:
|
|
================================
|
|
Openfire 3.10.2
|
|
|
|
Openfire is a real time collaboration (RTC) server licensed under the Open
|
|
Source Apache License.
|
|
It uses the only widely adopted open protocol for instant messaging, XMPP
|
|
(also called Jabber).
|
|
|
|
|
|
|
|
Vulnerability Type:
|
|
===================
|
|
Unrestricted File Upload
|
|
|
|
|
|
|
|
CVE Reference:
|
|
==============
|
|
N/A
|
|
|
|
|
|
|
|
|
|
Vulnerability Details:
|
|
=====================
|
|
|
|
Application specifies Plugin files (.jar) can be uploaded directly by using
|
|
the form, however so can the following.
|
|
|
|
.exe
|
|
.php
|
|
.jsp
|
|
.py
|
|
.sh
|
|
|
|
|
|
|
|
Exploit code(s):
|
|
===============
|
|
|
|
1) choose some malicious file using the File browser
|
|
2) click 'upload plugin'
|
|
|
|
http://localhost:9090/plugin-admin.jsp
|
|
|
|
Our malicious uploaded files will be stored under /openfire/plugins
|
|
directory.
|
|
|
|
|
|
|
|
Disclosure Timeline:
|
|
=========================================================
|
|
|
|
Vendor Notification: NA
|
|
Sept 14, 2015 : Public Disclosure
|
|
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Local
|
|
|
|
|
|
|
|
Severity Level:
|
|
=========================================================
|
|
Medium
|
|
|
|
|
|
|
|
Description:
|
|
==========================================================
|
|
|
|
|
|
Request Method(s): [+] POST
|
|
|
|
|
|
Vulnerable Product: [+] Openfire 3.10.2
|
|
|
|
|
|
Vulnerable Parameter(s): [+] fileName
|
|
|
|
|
|
Affected Area(s): [+] Server
|
|
|
|
|
|
===========================================================
|
|
|
|
[+] Disclaimer
|
|
Permission is hereby granted for the redistribution of this advisory,
|
|
provided that it is not altered except by reformatting it, and that due
|
|
credit is given. Permission is explicitly given for insertion in
|
|
vulnerability databases and similar, provided that due credit is given to
|
|
the author.
|
|
The author is not responsible for any misuse of the information contained
|
|
herein and prohibits any malicious use of all security related information
|
|
or exploits by the author or elsewhere.
|
|
|
|
by hyp3rlinx |