Tigase XMPP Server Stanza Smuggling
Posted by deepcore on May 26, 2022 – 11:30 pm
Tigase XMPP server suffers from a security vulnerability due to not escaping double quote character when serializing parsed XML. This can be used to smuggle (or, if you prefer, inject) an arbitrary attacker-controlled stanza in the XMPP server’s output stream. A malicious client can abuse this vulnerability to send arbitrary XMPP stanzas to another client (including the control stanzas that are only meant to be sent by the server).
Post a reply
You must be logged in to post a comment.