CVE-2020-24604: 
Openfire vulnerability analysis and mitigation

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request parameters "searchName", "searchValue", "searchDescription", "searchDefaultValue", "searchPlugin", and "searchDynamic" in server-properties.jsp and security-audit-viewer.jsp files (NVD).

The vulnerability is classified as a Cross-Site Scripting (XSS) attack that enables arbitrary code execution in a user's browser while connected to a trusted website. The application serves as a vehicle for the attack, targeting application users rather than the application itself. The vulnerability has a CVSS v3.1 Base Score of 6.1 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD, CSW).

The vulnerability can lead to stealing cookies, end-user files disclosure, and redirection of users to malicious pages or sites. When exploited, the XSS payload is executed whenever the user views the crafted request containing the malicious payload (CSW).

The vulnerability was discovered on February 4, 2020, and can be exploited by injecting malicious JavaScript payloads through various GET request parameters. A proof of concept demonstrated successful exploitation in Openfire version 4.5.0, where malicious payloads could be executed on the victim's browser upon visiting affected pages (CSW).

Recommended mitigations include performing context-sensitive encoding of untrusted input before echoing back to a browser using an encoding library, implementing input validation for special characters on all variables reflecting in the browser and storing in the database, and implementing client-side validation (CSW).