Description
Openfire versions before 4.8.1 did not remove a user's JID from the admin.authorizedJIDs property when the user was deleted. If an attacker knows the username of a deleted administrator and in-band registration is enabled, the attacker can recreate that account and inherit administrative access. An authenticated Openfire administrator can upload a management plugin containing a Java payload.
Openfire 4.8.1 prevents new stale entries when a user is deleted, but it does not migrate entries created by an older version. An upgraded server can therefore remain exploitable until the recreated account is deleted while the fix is present.
The ADMINUSERNAME option must identify a previously deleted administrator. The check method does not create accounts and cannot determine whether this target-specific state exists.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/multi/http/openfire/deleted_admin_rce_cve_2024_25420msf undefined(deleted_admin_rce_cve_2024_25420) > show actions ...actions...msf undefined(deleted_admin_rce_cve_2024_25420) > set ACTION < action-name >msf undefined(deleted_admin_rce_cve_2024_25420) > show options ...show and set options...msf undefined(deleted_admin_rce_cve_2024_25420) > runPrioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub