CVE-2019-20366

Root

Cause An XSS vulnerability was identified in Ignite Realtime Openfire version 4.4.4, specifically in the Manage Store Contents functionality. The isTrustStore parameter was not properly sanitized before being rendered in the admin console, allowing attackers to inject arbitrary HTML and JavaScript [1][2].

Exploitation

An attacker can exploit this by crafting a malicious URL containing a specially crafted isTrustStore value. If an authenticated admin user clicks the link, the injected script executes within the admin's session. No authentication is required for the attacker to craft the URL, but victim interaction (clicking) is necessary [4].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the admin console, potentially leading to session hijacking, administrative actions performed on behalf of the victim, or theft of sensitive data.

Mitigation

The issue was fixed in a subsequent commit [4] and merged via pull request [1]. Users are advised to upgrade to a patched version (4.4.5 or later) or apply the provided patch. No workaround is available without upgrading.