Openfire Stored Cross-Site Scripting Vulnerability in Node.js Plugin

A stored cross-site scripting vulnerability has been identified in Openfire version 4.6.0, specifically within the Node.js plugin. This vulnerability allows attackers to inject malicious scripts through the 'path' parameter. When crafted payloads containing script tags are submitted, they can execute arbitrary JavaScript in the context of administrative users who are viewing the Node.js configuration page.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected page.

Reproduction

To reproduce this vulnerability, an administrative user must access the Node.js configuration page in Openfire 4.6.0. Once there, an attacker can inject a script payload through the 'path' parameter, which will be executed when the page is viewed.