Free

CVE Series: Openfire (CVE-2023-32315)

If you're a cybersecurity practitioner who wants to know more about how to exploit and defend against CVE-2023-32315 (Openfire Path Traversal to RCE), you won't want to miss this course. You will identify the vulnerability, exploit it, and mitigate it in a hands-on, secure lab environment. Don't let Openfire catch you off guard.
1
0
M
Time
intermediate
difficulty
1
ceu/cpe

Course Content

Course Description

Description

CVE-2023-32315 is a path traversal vulnerability affecting the Openfire application, specifically the admin console, which allows an unauthenticated attacker to create an account on any unpatched server instance. Utilizing this attack vector, attackers can then achieve RCE on the underlying server. This application has been downloaded nearly 9 millions times and the vulnerability has been exploited in the wild.

Target Audience

This course is for seasoned red teamers, penetration testers, security and vulnerability assessment analysts, and system administrators who want to know how to exploit and protect against the latest vulnerabilities impacting enterprise systems.

Course Level

Intermediate. The course is best suited for those with a basic understanding of the CLI, Web traffic, and software management.

Prerequisites

Linux command line basics, web application protocols, and Java application basics.

Course Goals

By the end of this course, you should be able to:
  • Describe CVE-2023-32315 and its underlying cause
  • Find vulnerable Openfire instances and exploit them using publicly available exploit code
  • Mitigate CVE-2023-32315 on impacted systems
  • Helpful Links

  • Exploit Code: https://github.com/miko550/CVE-2023-32315 (PoC and vulnerable container code)
  • CVE Jira Tracker: https://igniterealtime.atlassian.net/browse/OF-2595 (Initial tracking information for CVE-2023-32315)
  • CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32315 (Official CVE)
  • Ignite Advisory: https://github.com/igniterealtime/Openfire/security/advisories/GHSA-gw42-f939-fhvm
  • Aqua Blog with IOCs for threat detection: https://blog.aquasec.com/kinsing-malware-exploits-novel-openfire-vulnerability
  • Medium Article with detailed analysis of the CVE:
  • https://learningsomecti.medium.com/path-traversal-to-rce-openfire-cve-2023-32315-6a8bf0285fcc

    This course is part of a Career Path:
    No items found.

    Instructed by

    Senior Instructor
    Clint Kehr

    Clint is a technical manager for a financial services company’s Responsible Disclosure Team, where he interacts with ethical hackers who find vulnerabilities in the company’s infrastructure. Clint is a former Special Agent with the Department of Justice where he specialized in internet investigations and conducted numerous cases on cyber threat actors on the surface, deep, and dark web, resulting in Clint earning the Attorney General’s Distinguished Service Award. Clint has trained over 1,000 law enforcement officers, prosecutors, and civilians on the dark web and dark market websites. Clint has a master’s degree in intelligence studies from American Military University where he graduated with honors and also has a master’s degree in Information Technology from Carnegie Mellon University where he graduated with highest distinction. As a former Navy Reserve Officer, Clint served in many roles, such as a division officer and department head for commands in the information warfare community.

    Instructor
    Lucas Romano

    Lucas is a seasoned threat researcher in multiple security disciplines, such as real-world adversarial tracking, network vulnerabilities, web exploitation, API abuse, and more. He began his career at the US Department of Defense, where he was trained by some of the world's best operators and analysts. Lucas now operates in the Cybrary red team, emulating real-world threat actors and running purple team exercises. He has 11 industry certifications, including the OSWA, GPEN, GAWN, GCFE, and RHCSA. He is also a member of the GIAC Advisory Board. In his free time, he enjoys working outdoors to improve his farm.

    Provider
    Cybrary Logo
    Certification Body
    Certificate of Completion

    Complete this entire course to earn a CVE Series: Openfire (CVE-2023-32315) Certificate of Completion