CVE-2019-20525

Vulnerability

Overview

Ignite Realtime Openfire version 4.4.1 is affected by a reflected cross-site scripting (XSS) vulnerability in the setup/setup-datasource-standard.jsp page. The driver POST parameter is not properly sanitized before being reflected back to the user, allowing an attacker to inject arbitrary HTML and JavaScript code [1][2].

Exploitation

This vulnerability can be exploited by sending a crafted request to the setup page with a malicious payload in the driver parameter. The attack does not require authentication, as the setup page is typically accessible without prior login. However, exploitation relies on social engineering to trick a user into clicking a crafted link or submitting a malicious form, as the XSS is reflected and not stored [2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This could lead to session hijacking, defacement of the setup interface, or redirection to malicious sites. The CVSS v3.0 score is 6.1 (Medium), with network attack vector, low complexity, and no privileges required, but user interaction is needed [1][2].

Mitigation

The vendor addressed this issue in a subsequent release; the advisory from Netsparker (now Invicti) indicates that the fix was implemented on 25 September 2019 [2]. Users should upgrade to Openfire version 4.4.2 or later to remediate the vulnerability.