CVE-2009-0496: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Ignite Realtime Openfire 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the (1) log parameter to (a) logviewer.jsp and (b) log.jsp; (2) search parameter to (c) group-summary.jsp; (3) username parameter to (d) user-properties.jsp; (4) logDir, (5) maxTotalSize, (6) maxFileSize, (7) maxDays, and (8) logTimeout parameters to (e) audit-policy.jsp; (9) propName parameter to (f) server-properties.jsp; and the (10) roomconfigroomname and (11) roomconfigroomdesc parameters to (g) muc-room-edit-form.jsp. NOTE: this can be leveraged for arbitrary code execution by using XSS to upload a malicious plugin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the Openfire administrative web interface (the pages serving logviewer.jsp, log.jsp, group-summary.jsp, user-properties.jsp, audit-policy.jsp, server-properties.jsp, and muc-room-edit-form.jsp, and the plugin upload functionality) to trusted IP addresses using network/firewall rules, host-based firewall, or a reverse-proxy with access controls.
- Operational
Audit installed Openfire plugins and remove any untrusted or unknown plugins. Monitor web access logs for requests containing the vulnerable parameters listed in the advisory (log, search, username, logDir, maxTotalSize, maxFileSize, maxDays, logTimeout, propName, roomconfig_roomname, roomconfig_roomdesc) to detect attempted XSS exploitation or plugin upload activity.
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0496?
CVE-2009-0496 is rated as a medium severity vulnerability due to the potential for cross-site scripting attacks.
How do I fix CVE-2009-0496?
To fix CVE-2009-0496, upgrade to a later version of Ignite Realtime Openfire that addresses these XSS vulnerabilities.
What types of attacks are possible with CVE-2009-0496?
CVE-2009-0496 allows remote attackers to execute arbitrary web scripts or HTML code on affected systems via cross-site scripting.
Which versions of Ignite Realtime Openfire are affected by CVE-2009-0496?
CVE-2009-0496 specifically affects Ignite Realtime Openfire version 3.6.2.
What components of Openfire are vulnerable in CVE-2009-0496?
CVE-2009-0496 affects logviewer.jsp, log.jsp, group-summary.jsp, and user-property.jsp components in Openfire.