Default Admin Credentials in JuggleIM im-server

Executive Summary

JuggleIM im-server through version 1.8.16 has default administrator credentials (admin/123456) that are shipped by default. Unauthenticated remote attackers can exploit this to access the admin console on port 8090. Even if an admin account is deleted, the system recreates it during login attempts, allowing persistent unauthorized access to control tenant applications and app secrets.

Useful 0 Not Useful 0

Detection Guidance

Check if port 8090 is open and accessible on your network. Use commands like 'nmap -p 8090 <target_IP>' to scan for the open port. Then attempt to access the admin console via a web browser at 'http://<target_IP>:8090' and try logging in with the default credentials admin/123456.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to gain full administrative control over the JuggleIM server without authentication. They can manipulate tenant applications, steal sensitive data like app secrets, and potentially disrupt services. The persistent nature of the admin account recreation makes remediation difficult.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control under GDPR and HIPAA. It enables unauthorized access to sensitive data, which could lead to data breaches. Organizations using JuggleIM may face regulatory penalties for failing to secure administrative access and protect user data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately change the default admin password to a strong, unique one. Disable or restrict access to port 8090 if not required. Update JuggleIM im-server to the latest version if a patch is available. Monitor for unauthorized access attempts.

Useful 0 Not Useful 0