CVE-2018-10847

What it actually does

The flaw allows an authenticated user session to migrate across virtual hosts on the same Prosody instance without re-verification of the host association during stream restarts, enabling unauthorized access to a different XMPP host.

Why it matters to the business

Attackers can cross tenant boundaries in multi-host XMPP deployments to access data or perform actions on unauthorized hosts, increasing risk of information disclosure or privilege escalation in shared environments.

How an attack unfolds

An attacker authenticates to one XMPP virtual host, then triggers a stream restart to migrate the already-authenticated session to a different virtual host on the same Prosody instance without additional credentials.

How to fix it

Upgrade Prosody to version 0.10.2 or 0.9.14 or later. For affected cockpit packages apply the listed fixes: cockpit (Debian:12) in 184-1 and cockpit-project/cockpit (GIT) in c51f6177576d7e12.

How to confirm the fix worked

Confirm Prosody version is at least 0.10.2 or 0.9.14; test that authenticated sessions cannot migrate across virtual hosts after stream restarts.

Typical attack path

1. Authenticate to XMPP host A
2. Trigger stream restart on the connection
3. Migrate the session to XMPP host B
4. Access resources or perform actions on host B using the migrated session

How to detect it

Review XMPP server logs for session restarts followed by access to a different virtual host than the original authentication target; look for authentication events lacking corresponding host verification.

What your security team should do

• Prioritize upgrade of Prosody instances to fixed versions immediately due to high CVSS and potential cross-host access
• Review multi-tenant XMPP configurations for virtual host isolation controls
• Monitor for any session migration anomalies in XMPP logs