CVE-2025-59154
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-15

Last updated on: 2025-09-16

Assigner: GitHub, Inc.

Description
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls X509Certificate.getSubjectDN().getName() and applies a regex to look for CN=. This method produces a provider-dependent string that does not escape special characters. In SunJSSE (sun.security.x509.X500Name), for example, commas and equals signs inside attribute values are not escaped. As a result, a malicious certificate can embed CN= inside another attribute value (e.g. OU="CN=admin,"). The regex will incorrectly interpret this as a legitimate Common Name and extract admin. If SASL EXTERNAL is enabled and configured to map CNs to user accounts, this allows the attacker to impersonate another user. The fix is included in Openfire 5.0.2 and 5.1.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-15
Last Modified
2025-09-16
Generated
2026-05-07
AI Q&A
2025-09-15
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
igniterealtime openfire 5.1.0
igniterealtime openfire 5.0.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in Openfire's SASL EXTERNAL mechanism arises from unsafe parsing of the Common Name (CN) attribute in client X.509 certificates. Instead of properly parsing the structured ASN.1 data, Openfire uses a method that returns an unescaped, provider-dependent string and applies a regex to extract the CN. In some implementations like SunJSSE, special characters inside attribute values are not escaped, allowing an attacker to craft a malicious certificate embedding a fake CN inside another attribute (e.g., OU="CN=admin,"). The regex then incorrectly extracts 'admin' as the CN. If SASL EXTERNAL is enabled and CNs are mapped to user accounts, this allows an attacker to impersonate other users. [1]


How can this vulnerability impact me? :

If you use Openfire with SASL EXTERNAL authentication enabled and map CNs to user accounts, this vulnerability allows an attacker to impersonate other users by presenting a maliciously crafted client certificate. This can lead to unauthorized access to user accounts and potentially sensitive information. The attack requires network access and high privileges but no user interaction. The impact affects confidentiality and integrity but not availability. [1]


How can this vulnerability be detected on my network or system? Can you suggest some commands?

Detection involves identifying if your Openfire server is running a vulnerable version prior to 5.0.2 and if SASL EXTERNAL mechanism with CN-based client TLS authentication is enabled. You can check the Openfire version by running commands like `dpkg -l | grep openfire` on Debian-based systems or checking the Openfire admin console. To detect suspicious client certificate usage, you can analyze Openfire logs for authentication attempts using SASL EXTERNAL and look for unusual CN values that may indicate crafted certificates. There are no specific commands provided for direct detection of the vulnerability itself, but monitoring authentication logs and verifying Openfire version are key steps. [1]


What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include upgrading Openfire to version 5.0.2 or later, where the vulnerability is fixed by using safe LDAP parsing and preferring SAN-based identities. If upgrading is not immediately possible, you can deploy a custom certificate identity mapping class that safely parses certificates, configure Openfire to prefer SAN-only identity mapping (noting this may break CN-only certificate authentication), or disable certificate-based authentication altogether, understanding the trade-offs involved. [1]


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart