CVERadar
HIGH · CVSS 3.1 7.5CISA KEV · added 2023-08-24Metasploit modulePublic PoCEPSS 100.00% (p100)Threat level 82

CVE-2023-32315: Ignite Realtime Openfire Path Traversal Vulnerability

Ignite Realtime · Openfire · NVD published 2023-05-27 · posted 2026-10-21 · last modified 2026-06-17

What it is

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup Environment in an already configured Openfire environment to access restricted pages in the Openfire Admin Console reserved for administrative users. This vulnerability affects all versions of Openfire that have been released since April 2015, starting with version 3.10.0. The problem has been patched in Openfire release 4.7.5 and 4.6.8, and further improvements will be included in the yet-to-be released first version on the 4.8 branch (which is expected to be version 4.8.0). Users are advised to upgrade. If an Openfire upgrade isn’t available for a specific release, or isn’t quickly actionable, users may see the linked github advisory (GHSA-gw42-f939-fhvm) for mitigation advice.

WeaknessCWE-22
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (source: [email protected])
CISA due date2023-09-14 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsPersistence → Stealth → Discovery → Impact

Exploitation evidence

First exploit evidence seen: 2023-05-26 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2023-08-24. Source

Public exploit code

Metasploit

GitHub proof-of-concept repositories

11 public repositories from 11 accounts, first seen 2023-06-14. Most starred: tangxiaofeng7/CVE-2023-32315-Openfire-Bypass (143 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2023-32315 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 82/100
Defender level 1 · 0 XP
Chain links broken: 0/4

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1505.003 Web Shell CTID: primary impact

CVE-2023-32315 is a path traversal bug in Openfire's administrative console that could be leveraged for remote code execution. Public reports have indicated that threat actors were exploiting this vulnerability to gain access to the Openfire plugins interface to create new admin console user accounts, install a malicious plugin, and gain access to a webshell.

How to fix it

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • igniterealtime openfire: upgrade to 4.6.8 or later (affected from 3.10.0)
  • igniterealtime openfire: upgrade to 4.7.5 or later (affected from 4.7.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1042 Disable or Remove Feature or Program (for T1505.003) : Consider disabling functions from web technologies such as PHP’s `evaI()` that may be abused for web shells.
  • M1018 User Account Management (for T1505.003) : Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.
  • M1028 Operating System Configuration (for T1087.002) : Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names. The Registry key is located at <code>HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators</code>. It can be disabled through GPO: Com

Detection Generic guidance

  • Persistence: Look for new files in web roots, new scheduled tasks/services, and new accounts created after the exposure window.
  • Discovery: Look for directory listing, file enumeration and reconnaissance commands from service accounts.
  • Impact: Monitor service availability, unexpected encryption activity and mass file changes.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources