Openfire auth bypass (CVE-2023-32315)

Openfire is an XMPP server with a web admin console (ports 9090/9091). CVE-2023-32315 is a path traversal in that console affecting versions <= 3.10.0 and 4.x before 4.7.5. By abusing faulty URL normalization over the setup routes (/setup/setup-*/..\..\...), an unauthenticated attacker reaches restricted admin pages.

The real impact is that, bypassing authentication, one can create a new administrator account. From there, the panel allows uploading .jar plugins, which gives code execution with the Openfire service's privileges. A public exploit automates the admin creation:

python3 CVE-2023-32315.py -u http://<ip>:9090
# -> Username / Password of the created admin

Then, from Plugins → Upload Plugin, upload a malicious plugin (for example a "management tool" with an Execute command) and run a reverse shell.

Nuances. The bypass grants admin access, not direct RCE: code execution comes from uploading a plugin. Openfire is usually exposed on the management LAN; verify the version (the interface shows it) before assuming vulnerability.

How to detect it. The bypass leaves unauthenticated requests to /setup/setup-*/ routes with encoded traversal sequences (%c0%2e, ..\, %5c) in the console log (9090/9091), something normal operation never produces once installation is finished. The highest-fidelity signal is the creation of a new administrator account in Openfire's security log followed, minutes later, by the upload of a .jar plugin from the panel: that sequence (traversal, admin creation, plugin upload, execution) is the full attack chain.

Defence. Update to Openfire 4.7.5+, do not expose the admin console to untrusted networks and restrict plugin uploads. Related to LFI / path traversal, file upload to RCE and credentials in source/config.