Port 7070 – Openfire / RealServer

TCP

Port 7070 is used by Openfire XMPP server for HTTP binding (BOSH) and historically by RealNetworks RealServer for streaming. Openfire's HTTP binding on port 7070 allows XMPP clients to connect via HTTP long-polling when WebSocket or direct TCP (port 5222) is unavailable. Use port 7443 for the TLS-encrypted equivalent.

Port Number

7070

Protocol

TCP

Service

Openfire BOSH / RealServer

Range

IANA Registered (1024–49151)

Description

Openfire XMPP server uses port 7070 for HTTP Binding (BOSH – Bidirectional-streams Over Synchronous HTTP). BOSH allows XMPP communication through HTTP, enabling web-based chat clients to connect when direct TCP connections on port 5222 are blocked by firewalls or corporate proxies. Historically, RealNetworks RealServer also used port 7070 for streaming media. In modern networks, port 7070 almost always indicates an Openfire installation. The Openfire admin console runs on separate ports (9090 HTTP / 9091 HTTPS). If HTTP binding is not required for web clients, disable port 7070 to reduce attack surface. Use port 7443 for TLS-encrypted BOSH connections.

Security risks

1CVE-2023-32315 (CVSS 8.6): Openfire admin console path traversal to RCE – unauthenticated attacker bypasses authentication via path traversal in the admin console (/setup/setup-s/%u002e%u002e/log.jsp) to upload malicious plugins achieving full remote code execution. Actively exploited in the wild since May 2023 for cryptomining and backdoor deployment. Affects Openfire 3.10.0 through 4.7.4. Patch to 4.7.5+ immediately.
2BOSH endpoint abuse: the HTTP binding (BOSH) endpoint on port 7070 (/http-bind/) proxies XMPP connections over HTTP. Without rate limiting, attackers can exhaust server resources by opening thousands of BOSH sessions. Each session maintains server-side state (memory + thread), enabling denial-of-service.
3Unencrypted XMPP over HTTP: port 7070 serves BOSH over plaintext HTTP. All XMPP stanzas (messages, presence, roster) are visible to network observers. Chat messages, authentication tokens (SASL), and presence information travel in cleartext. Use port 7443 (BOSH over HTTPS) exclusively.
4Admin console on adjacent ports: Openfire's admin console (ports 9090/9091) is often on the same host. CVE-2023-32315 targets the admin console but the attack vector may be reached via port 7070 misconfigurations or reverse proxy routing errors that expose admin paths.

Firewall guidance

Disable port 7070 entirely if no web-based XMPP clients need BOSH access – configure this in Openfire Admin Console → Server → Server Settings → HTTP Binding. If BOSH is needed, use port 7443 (HTTPS) only and proxy through Nginx with rate limiting. Block ports 9090/9091 (admin console) from all external access. After CVE-2023-32315, audit for compromised Openfire plugins: check plugins/ directory for unknown .jar files.

Diagnosis commands

Test if BOSH endpoint is accessible (should return 200 or connection refused if disabled)

shell

curl -s http://host:7070/http-bind/ -o /dev/null -w '%{http_code}'

Test for CVE-2023-32315 path traversal (should return 404/403 if patched)

shell

curl -s 'http://host:7070/setup/setup-s/%u002e%u002e/log.jsp' -o /dev/null -w '%{http_code}'

Discover all Openfire ports on a host

shell

nmap -sV -p 7070,7443,9090,9091 target

Check for unexpected/malicious plugins (post-exploitation indicator)

shell

ls -la /opt/openfire/plugins/ | grep -v 'admin\|search'

Usage examples

Port 7070 – Openfire / RealServer

shell

curl http://xmpp.example.com:7070/http-bind/
openfire: server.xml httpbind port
converse.js bosh_service_url: 'https://host:7443/http-bind/'

Common services on this port

Openfire XMPP ServerConverse.js (web client)Strophe.js (XMPP library)Candy (web chat UI)

Related ports

7443

Openfire BOSH over HTTPS (TLS)

5222

XMPP client-to-server (direct TCP)

5269

XMPP server-to-server (federation)

9090

Openfire admin console HTTP

9091

Openfire admin console HTTPS

History

Openfire (originally named Wildfire, then Jive Messenger) was created by Jive Software in 2001 and open-sourced under the Apache License. Port 7070 was chosen for HTTP binding (BOSH, XEP-0124) to allow web clients to connect when direct TCP on port 5222 was blocked. RealNetworks RealServer historically also used port 7070 for streaming media, but this usage is effectively extinct. CVE-2023-32315 in 2023 brought Openfire back into the spotlight as thousands of internet-facing instances were compromised.

FAQ

How do I patch CVE-2023-32315?

Upgrade to Openfire 4.7.5 or 4.6.8 (LTS). If immediate upgrade is impossible: (1) Block access to the admin console (ports 9090/9091) from all external networks, (2) Check for compromise: look for unknown plugins in /opt/openfire/plugins/, unknown admin users, and scheduled tasks. (3) The vulnerability is in the admin console's setup path – even if you only expose port 7070, verify no reverse proxy routes admin paths.

Should I use BOSH (7070/7443) or WebSocket for web XMPP?

WebSocket is preferred for new deployments – lower latency, true bidirectional communication, and modern browser support is universal. BOSH exists for environments where WebSocket is blocked (some corporate proxies). Openfire supports both: WebSocket on ws://host:7070/ws/ or wss://host:7443/ws/, BOSH on http://host:7070/http-bind/. Disable whichever transport you don't use.