exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

SA-20070722-0.txt

SA-20070722-0.txt
Posted Jul 23, 2007
Authored by Johannes Greil | Site sec-consult.com

SEC Consult Security Advisory - SEC Consult has discovered an arbitrary code execution flaw in Joomla! version 1.5 beta 2.

tags | exploit, arbitrary, code execution
SHA-256 | 27257772ee84bdb082f3c8d0b36b605e8ca0215067cd5b2505a0b873391955c4

SA-20070722-0.txt

Change Mirror Download
SEC Consult Security Advisory < 20070722-0 >
=======================================================================
title: Remote command execution in Joomla! CMS
program: Joomla!
vulnerable version: 1.5 beta 2
Earlier 1.5 versions may be vulnerable too!
impact: critical
homepage: http://www.joomla.org
found: 2007-05-20
by: Johannes Greil / SEC Consult / www.sec-consult.com
=======================================================================

Vendor description:
-------------------

Joomla! is an award-winning Content Management System (CMS) that will
help you build websites and other powerful online applications. Best of
all, Joomla! is an open source solution that is freely available to
everybody. Joomla! is used all over the world to power everything from
simple, personal homepages to complex corporate web applications.

[source: http://www.joomla.org/content/view/12/26/]



Vulnerability overview:
-----------------------

The search component of Joomla! allows an attacker to execute arbitrary
PHP commands. It is e.g. possible to execute OS commands via system()
calls. PHP is set to the settings recommended by the Joomla! installer!


An attacker does not need to be authenticated to perform this attack!


Vulnerability description:
--------------------------

The following scripts of a default Joomla! 1.5 beta 2 installation
contain the vulnerable code:

1) components/com_search/views/search/tmpl/default_results.php

line 12: <?php eval ('echo "'. $this->result .'";'); ?>

2) templates/beez/html/com_search/search/default_results.php

line 25: echo '<p>' . eval ('echo "' . $this->result . '";');


Input of the "searchword" parameter is being passed to the mentioned
eval() code and executed. An attacker is able to append new PHP commands
after the "echo" language construct which can be used for OS command
execution.

In order to bypass the search word length limitation of 20 characters a
new GET parameter is being used to specify the OS commands (see proof of
concept).


Proof of concept:
-----------------
http://$joomlahost/index.php?searchword=";phpinfo();%23&option=com_search&Itemid=1
http://$joomlahost/index.php?c=id&searchword=";system($_GET[c]);%23&option=com_search&Itemid=1


Vulnerable versions:
--------------------

The following versions were found to be vulnerable:
* 1.5 beta 2

Earlier versions of Joomla! 1.5 beta have not been tested and may be
vulnerable too!

The stable version 1.0.13 of Joomla! does not contain the vulnerable
code and is not affected by this security issue.


Vendor contact timeline:
------------------------

2007-05-21: vendor notified via email (security@joomla.org)
2007-05-21: vendor replied and fixed the issue in SVN
URL:
http://joomlacode.org/gf/project/joomla/scmsvn/?action=browse&path=%2Fdevelopment%2Ftrunk%2Fcomponents%2Fcom_search%2Fviews%2Fsearch%2Fview.php&r1=7455&r2=7456

2007-07-21: vendor released RC1 of Joomla! 1.5
2007-07-22: coordinated disclosure date, special greetings to Rob!


Solution:
---------
The vendor does not recommend using the development version v1.5 beta
for production sites and suggests using the latest stable version(s).

If Joomla! v1.5 beta is being used, upgrade to v1.5 RC1 immediately
which fixes the issue!


Patch/Workaround:
-----------------
Use the fix from SVN (check out at least revision 7456 of
/development/trunk/components/com_search/views/search/view.php)


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

SEC Consult conducts periodical information security workshops on ISO
27001/BS 7799 in cooperation with BSI Management Systems. For more
information, please refer to http://www.sec-consult.com/236.html

EOF Johannes Greil / @2007

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close