pulentoski/explotacion-cve-2023-32315-openfire
The CVE-2023-32315 vulnerability affects Openfire servers, allowing an attacker to bypass the web admin panel login without valid credentials. The exploit adds an administrative user, allowing the attacker to upload a malicious plugin and obtain a web shell.
CVE-2023-32315 is a vulnerability in Openfire that allows access to the JSPs of the initial setup wizard (/setup/setup-s/...)
even after it has been completed, exploiting poor path validation via path traversal with Unicode/"best-fit" encoding
(%u002e%u002e, equivalent to ../), instead of literal characters. This allows reaching user-groups.jsp and user-create.jsp without authentication,
as if the server were freshly installed, and create a new admin user. The script validates the result in two ways: checking if
the user appears in user-summary.jsp, and verifying that the created credentials work on login.jsp. Once inside the panel, the
next step (outside the scope of this script) would be to upload a malicious plugin to execute arbitrary commands.
git clone https://github.com/pulentoski/Explotacion-CVE-2023-32315-Openfire.git
cd Explotacion-CVE-2023-32315-Openfire
It requires no external dependencies — it only uses standard Python 3 libraries (http.client, re, time, urllib.parse).
The script is interactive, with no command-line flags:
python3 exploit.py
It will ask you to choose a mode:
[1] Single target → you enter the URL directly (e.g., http://127.0.0.1:9090)
[2] List of targets → you enter the path to a .txt with one URL per line
The username/password it creates (pepe2/pepe2) is hardcoded at the beginning of the script — change it there if needed.
📄 Results: confirmed targets are saved in exito.txt; if a target fails verification, the response HTML is saved in debug_<user>.html for manual review.
("openfire") && icon_hash=="1211608009"
This script is intended for controlled environments and authorized audits. The author is not responsible for misuse.