HTTP: Jive Software Openfire Jabber Server Authentication Bypass

An authentication bypass vulnerability exists in Openfire Server product by Jive Software. The vulnerability is due to an insecure design in the Tomcat filter where all functions in the admin web-interface are not protected from unauthorized access. Remote attackers could exploit this vulnerability to access functions in the admin web-interface without supplying valid credentials. A successful attack attempt will bypass the server authentication and the attacker can have full access to all functions in the admin webinterface without providing any user credentials. Thus the attacker can gain full control of the Openfire Jabber server and cause disclosure of sensitive information.

Extended Description

Openfire is prone to multiple input-validation vulnerabilities: - An SQL-injection issue. - Multiple cross-site scripting issues. - An authentication-bypass issue. A successful exploit of these issues may allow an attacker to gain unauthorized access to the affected application, compromise the application, access or modify data, exploit vulnerabilities in the underlying database, execute arbitrary script code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible. Openfire 3.6.0a is vulnerable; other versions may also be affected.

Affected Products

Ignite_realtime openfire

References

BugTraq: 32189

CVE: CVE-2008-6508

URL: http://community.igniterealtime.org/thread/35874

Short Name

HTTP:JABBER-SERVER-BYPASS

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Jive Software Openfire Jabber Server Authentication Bypass

Extended Description

Affected Products

References

Found a potential security threat?