CVE-2024-25421: 
Java vulnerability analysis and mitigation

An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. The vulnerability was discovered and disclosed on March 26, 2024, and has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) (NVD, HackTheBox).

The vulnerability exists in the ROOM_CACHE component where if a user is added to a group chat, their affiliation and related data are stored in the cache. When this user is deleted, the cache is not updated to reflect the new state of the group, allowing a new user with the same username to gain access to the group chat with the same level of privileges as the previously deleted user. The ROOM_CACHE value does not change until the web server is restarted because the expiry date is set to never expire, and the cache is not re-evaluated after user deletion (HackTheBox).

The vulnerability allows attackers to gain unauthorized access to group chats with elevated privileges. Since websites generally aim for constant workflow and don't restart often, attackers can bruteforce registration of OSINT-gathered usernames and attempt to refresh the group chat list of each registered account to gain access to group chats that deleted users had access to. This becomes particularly significant in internal environments where attackers could gather information about users that have been deleted or left the organization (HackTheBox).

The vulnerability can be exploited through the following steps: 1) Create a new user and add them to a group chat with any affiliation, 2) Delete the user, 3) Create a new user with the same username as the deleted user, 4) The new user will have access to the group chat with the same privileges as the deleted user, including access to previous messages and corresponding role actions (HackTheBox).