Openfire LFI

Ignite Realtime supports Openfire, a Jabber server. It’s a Java program that serves as a platform for medium-sized businesses to manage internal communications and make instant messaging more convenient. The FaviconServlet in earlier versions of the Openfire Admin Console is vulnerable to a full read SSRF vulnerability. Attackers can use this vulnerability to send arbitrary HTTP GET queries to the internal network and view the responses.

Mitigation / Precaution

We suggest that you upgrade to the most recent version.

Written by

Anandhu Krishnan

Lead Engineer

Anandhu is an accomplished Senior Lead Engineer with a strong focus on back-end development. His expertise lies in architecting and optimizing the core of software applications to ensure they run smoothly and efficiently. With a meticulous attention to detail and a deep understanding of data management and server-side operations, Anandhu has been a driving force behind the success of various back-end projects.