CVE-2019-18394: Openfire Full Read SSRF

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-18394
• https://swarm.ptsecurity.com/openfire-admin-console/
• https://github.com/igniterealtime/Openfire/pull/1497
• https://www.tenable.com/plugins/nessus/202697
• https://www.invicti.com/web-application-vulnerabilities/openfire-admin-console-full-read-ssrf
• https://access.redhat.com/security/cve/cve-2019-18394
• https://threatprotect.qualys.com/2020/08/24/multiple-vulnerabilities-in-openfire-admin-console/
• https://github.com/ping-0day/templates/blob/main/CVE-2019-18394.yaml
• https://pentest-tools.com/vulnerabilities-exploits/openfire-443-multiple-vulnerabilities_10026
• https://beaglesecurity.com/blog/vulnerability/openfire-full-read-ssrf.html

Related Vulnerabilities

• PoCOpenfire /getFavicon 服务端请求伪造漏洞（CVE-2019-18394）
• PoCCVE-2019-18393: Ignite Realtime Openfire <4.42 - Local File Inclusion
• PoCCVE-2019-18394: Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery
• PoCCVE-2023-32315: Openfire Administration Console - Authentication Bypass
• PoCCVE-2023-32315-2: Openfire身份认证绕过漏洞
• PoCCVE-2023-32315: Openfire Console authentication bypass
• PoCopenfire-default-password: OpenFire 默认账号密码
• PoCopenfire-setup: Openfire Setup - Exposure
• Ignite Realtime Openfire <=4.4.2存在服务端请求伪造漏洞(CVE-2019-18394)
• Openfire CVE-2019-18394 未授权服务器端请求伪造漏洞
• Openfire CVE-2023-32315权限绕过漏洞
• Openfire Console 存在弱口令
• Openfire Console 存在鉴权绕过漏洞