CVE-2022-45197

What it actually does

The library performs no hostname validation on the TLS certificate presented by the remote XMPP server, allowing an attacker-controlled certificate to be accepted for any domain.

Why it matters to the business

Attackers can silently intercept, read, or alter all XMPP traffic, undermining the confidentiality and integrity of messaging, presence, and file-transfer flows used by dependent applications.

How an attack unfolds

An attacker positions a network device or rogue server between the client and the legitimate XMPP server, presents a certificate containing the target hostname, and the unauthenticated Slixmpp client completes the TLS handshake and proceeds to exchange stanzas over the attacker-controlled channel.

How to fix it

Upgrade slixmpp to version 1.8.3 or later; if an upgrade is not immediately possible, enforce certificate pinning or route traffic through a trusted proxy that performs proper hostname validation.

How to confirm the fix worked

Inspect the installed slixmpp package version and confirm it is 1.8.3 or newer; review application logs for successful TLS connections that previously would have used the vulnerable code path.

Typical attack path

1. Place attacker-controlled endpoint or MITM device on the network path to the target XMPP server
2. Obtain or generate a certificate containing the legitimate server hostname
3. Wait for or trigger a Slixmpp client connection attempt
4. Complete TLS handshake without hostname verification
5. Read, modify, or inject XMPP stanzas at will

How to detect it

Search application and network logs for XMPP connections that completed TLS handshakes with certificates whose subject or SAN did not match the expected hostname; look for sudden changes in remote IP addresses or certificate fingerprints on established XMPP sessions.

What your security team should do

• Prioritize upgrade of all slixmpp installations to 1.8.3 or later
• Add dependency scanning rules to block future vulnerable releases
• Enable TLS certificate logging for XMPP connections to detect anomalous certificates
• Review downstream applications that embed slixmpp for exposure