What this actually is.
Technical background, root cause, and affected surface.
Ignite Realtime Openfire 4.5.1 has a reflected Cross-site scripting vulnerability which allows an attacker to execute arbitrary malicious URL via the vulnerable GET parameters in the Client Sessions and User Summary admin pages.
- Vendor
- Openfire
- Affected Product
- Ignite Realtime Openfire
- CVE
- CVE-2020-24602
- Securin ID
- 2020-CSW-01-1040
- Status
- Fixed
- Date
- February 4, 2020
- Severity
- Medium
- CVSS Score
- 6.1
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CWE
- CWE-79
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Stealing cookies
End-user files disclosure.
Redirection of the user to some other page or site.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Perform context-sensitive encoding of untrusted input before it is echoed back to a browser by using an encoding library. Implement input validation for special characters on all the variables that are reflecting to the browser and storing it in the database. Implement client-side validation.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vulnerability Discovered by CSW Security Researcher.
Vulnerability Reported to Vendor
Vendor responded with bug tracker Links
Follow up with vendor for fix release
Follow up with Vendor for fix release
Vendor responded with released fix
Request for CVE
CVE Assigned
Vendor Updated CVE in the bug tracker and Request for an update in CVE
CVE Published in NVD
Disclosed 31 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.