CVE-2021-45968
📋 TL;DR
This vulnerability allows Server-Side Request Forgery (SSRF) attacks against the XMPP Server component in Pascom Cloud Phone System and other JIve platform products. Attackers can make the vulnerable server send unauthorized requests to internal systems, potentially accessing sensitive data or services. Organizations using Pascom Cloud Phone System before version 7.20.x or other affected JIve platform products are at risk.
💻 Affected Systems
- Pascom Cloud Phone System
- JIve platform XMPP Server
📦 What is this software?
Jive by Jivesoftware
⚠️ Risk & Real-World Impact
Worst Case
Full internal network compromise through SSRF chaining with other vulnerabilities, allowing attackers to access internal services, exfiltrate sensitive data, or pivot to other systems.
Likely Case
Unauthorized access to internal HTTP services, metadata services, or cloud instance metadata, potentially leading to credential theft or internal reconnaissance.
If Mitigated
Limited impact due to network segmentation, egress filtering, and proper authentication controls on internal services.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and this appears to be related to CVE-2019-18394. Public research and blog posts demonstrate exploitation techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Pascom Cloud Phone System 7.20.x or later
Vendor Advisory: https://www.pascom.net/doc/en/release-notes/
Restart Required: Yes
Instructions:
1. Upgrade Pascom Cloud Phone System to version 7.20.x or later. 2. For JIve platform products, check with vendor for updated xmppserver jar. 3. Restart Tomcat service after patching.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the vulnerable server to only necessary internal services
Tomcat URL Filtering
allImplement request filtering in Tomcat to block SSRF attempts
Add URL filtering rules to Tomcat's web.xml configuration
🧯 If You Can't Patch
- Implement strict network egress filtering to prevent the vulnerable server from accessing internal services
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check Pascom version via admin interface or check for vulnerable xmppserver jar in Tomcat deploymentsCheck Version:
Check Pascom admin dashboard or consult vendor documentation for version verificationVerify Fix Applied:
Verify Pascom version is 7.20.x or later and test SSRF endpoints are no longer accessible📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from Tomcat server
- Requests to internal IP addresses or metadata services
- 429 or 5xx errors from internal services
Network Indicators:
- HTTP traffic from Tomcat server to unexpected internal destinations
- Requests to cloud metadata endpoints (169.254.169.254, etc.)
SIEM Query:
source="tomcat" AND (dest_ip=PRIVATE_IP_RANGE OR dest_ip=169.254.169.254) AND http_method=GET🔗 References
- https://jivesoftware.com/platform/
- https://kerbit.io/research/read/blog/4
- https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
- https://www.pascom.net/doc/en/release-notes/
- https://www.pascom.net/doc/en/release-notes/pascom19/
- https://jivesoftware.com/platform/
- https://kerbit.io/research/read/blog/4
- https://tutorialboy24.blogspot.com/2022/03/the-story-of-3-bugs-that-lead-to.html
- https://www.pascom.net/doc/en/release-notes/
- https://www.pascom.net/doc/en/release-notes/pascom19/
