CVE-2018-10847 Auth bypass in prosody

Medium 4.2 Published 30 Jul 2018 Updated 5 Aug 2024

Attackers can bypass authentication by migrating sessions between virtual hosts, allowing unauthorized access to other users' accounts on the same Prosody instance.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-10847?

CVE-2018-10847 is a medium-severity authentication bypass vulnerability in [UNKNOWN] prosody, published on 30 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

prosody before versions 0.10.2, 0.9.14 is vulnerable to an Authentication Bypass. Prosody did not verify that the virtual host associated with a user session remained the same across stream restarts. A user may authenticate to XMPP host A and migrate their authenticated session to XMPP host B of the same Prosody instance.

Weakness: CWE-287, CWE-592

Which versions are affected by CVE-2018-10847?

It affects 1 product.

Products include Prosody Prosody.

How do I fix CVE-2018-10847?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-10847 being exploited?

There is no known exploitation of CVE-2018-10847 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2018-10847, DSA-4216-1, GHSA-r7gq-256h-j4mq, UBUNTU-CVE-2018-10847, USN-4834-1.