Openfire CVE-2023-32315 (admin console authentication bypass via path traversal in the setup environment, CISA KEV): which versions are fixed and how do I protect the admin console on ports 9090/9091?

What it is: CVE-2023-32315 affects Openfire, the XMPP chat server from Ignite Realtime. A path traversal weakness in the web admin console (using URL encodings the embedded web server accepted) let an unauthenticated user reach admin-only pages through the setup environment, even on an already configured server. Attackers used it to create admin accounts and upload malicious plugins, which runs code on the server. Disclosed in May 2023 (CVSS 8.6); CISA added it to the KEV catalog in August 2023, and internet-exposed Openfire admin consoles kept being hit afterwards. Am I affected: - Openfire 3.10.0 through 4.7.4 (the 4.6 line before 4.6.8 and the 4.7 line before 4.7.5). - Exposure: the admin console listens on ports 9090 (HTTP) and 9091 (HTTPS); risk is highest if those are reachable from untrusted networks. - Check the version on the admin console's Server Information page or in the startup log. Fix: 1. Upgrade to 4.6.8, 4.7.5 or 4.8.0+ (today, the current release). 4.8.0 also binds the admin console to loopback by default. Update affected plugins too (per the advisory: Random Avatar 1.1.0+, Monitoring Service 2.5.0+, HTTP File Upload 1.3.0+). 2. Workarounds from the advisory until you can upgrade: never expose ports 9090/9091 to the internet (firewall, security group, VPN; in Docker bind them to 127.0.0.1), or bind the admin console to loopback with <interface>127.0.0.1</interface> under <adminConsole> in conf/openfire.xml, or use the AuthFilterSanitizer plugin. Editing web.xml to remove wildcard exclusions is possible but fragile. 3. Check for compromise if an affected console was reachable: review admin accounts for ones you didn't create, the installed plugins list for anything unfamiliar, recent changes in the configuration, and web/access logs for requests to setup paths containing encoded traversal sequences ('%u002e' and 'setup-s/'). If you find signs, rebuild the server, remove rogue plugins and accounts, and rotate admin and database credentials. Verify: the admin console shows a fixed version, ports 9090/9091 aren't reachable from outside, and the admin user and plugin lists contain only what you expect. Sources: https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm https://nvd.nist.gov/vuln/detail/CVE-2023-32315 https://www.cisa.gov/known-exploited-vulnerabilities-catalog