what you don't know can hurt you

Openfire 3.10.2 Arbitrary File Upload

Openfire 3.10.2 Arbitrary File Upload
Posted Sep 15, 2015
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Openfire version 3.10.2 suffers from an arbitrary local file upload vulnerability.

tags | exploit, remote, file upload
MD5 | 47dd5bddd03d30a73a3cb61b81fb9673

Openfire 3.10.2 Arbitrary File Upload

Change Mirror Download
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-FILE-UPLOAD.txt



Vendor:
=========================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Unrestricted File Upload



CVE Reference:
==============
N/A




Vulnerability Details:
=====================

Application specifies Plugin files (.jar) can be uploaded directly by using
the form, however so can the following.

.exe
.php
.jsp
.py
.sh



Exploit code(s):
===============

1) choose some malicious file using the File browser
2) click 'upload plugin'

http://localhost:9090/plugin-admin.jsp

Our malicious uploaded files will be stored under /openfire/plugins
directory.



Disclosure Timeline:
=========================================================

Vendor Notification: NA
Sept 14, 2015 : Public Disclosure



Exploitation Technique:
=======================
Local



Severity Level:
=========================================================
Medium



Description:
==========================================================


Request Method(s): [+] POST


Vulnerable Product: [+] Openfire 3.10.2


Vulnerable Parameter(s): [+] fileName


Affected Area(s): [+] Server


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    32 Files
  • 25
    Nov 25th
    7 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close