Remote command execution in Joomla! CMS

SEC Consult Security Advisory < 20070722-0 >

=======================================================================

title: Remote command execution in Joomla! CMS

program: Joomla!

vulnerable version: 1.5 beta 2

Earlier 1.5 versions may be vulnerable too!

impact: critical

homepage: www.joomla.org

found: 2007-05-20

by: Johannes Greil / SEC Consult / www.sec-consult.com

=======================================================================

 

Vendor description:

-------------------

 

Joomla! is an award-winning Content Management System (CMS) that will help you

build websites and other powerful online applications. Best of all, Joomla! is

an open source solution that is freely available to everybody. Joomla! is used

all over the world to power everything from simple, personal homepages to

complex corporate web applications.

 

[source: www.joomla.org/content/view/12/26/]

 

 

 

Vulnerability overview:

-----------------------

 

The search component of Joomla! allows an attacker to execute arbitrary PHP

commands. It is e.g. possible to execute OS commands via system() calls. PHP

is set to the settings recommended by the Joomla! installer.

 

 

An attacker does not need to be authenticated to perform this attack!

 

 

Vulnerability description:

--------------------------

 

The following scripts of a default Joomla! 1.5 beta 2 installation contain the

vulnerable code:

 

1) components/com_search/views/search/tmpl/default_results.php

 

line 12: <?php eval ('echo "'. $this->result .'";'); ?>

 

2) templates/beez/html/com_search/search/default_results.php

line 25: echo '<p>' . eval ('echo "' . $this->result . '";');

 

 

Input of the "searchword" parameter is being passed to the mentioned eval()

code and executed. An attacker is able to append new PHP commands after the

"echo" language construct.

 

In order to bypass the search word length limitation of 20 characters a new

GET parameter is being used to specify the OS commands (see proof of concept).

 

 

Proof of concept:

-----------------

http:// $joomlahost/index.php?searchword=";phpinfo();%23&option=com_search&Itemid=1

http:// $joomlahost/index.php?c=id&searchword=";system($_GET[c]);%23&option=com_search&Itemid=1

 

 

Vulnerable versions:

--------------------

 

The following versions were found to be vulnerable:

* 1.5 beta 2

 

Earlier versions of Joomla! 1.5 have not been tested and may be vulnerable too!

 

The stable version 1.0.13 of Joomla! does not contain the vulnerable code and

is not affected by this security issue.

 

 

Vendor contact timeline:

------------------------

 

2007-05-21: vendor notified via email (security@joomla.org)

2007-05-21: vendor replied and fixed the issue in SVN

URL: joomlacode.org/gf/project/joomla/scmsvn/

 

2007-07-21: vendor released RC1 of Joomla! 1.5

2007-07-22: coordinated disclosure date, special greetings to Rob!

 

 

Solution:

---------

The vendor does not recommend using the development version v1.5 beta for

production sites and suggests using the latest stable version(s).

 

If Joomla! v1.5 beta is being used, upgrade to v1.5 RC1 immediately which fixes the issue!

 

 

Patch/Workaround:

-----------------

Use the fix from SVN (check out at least revision 7456 of

/development/trunk/components/com_search/views/search/view.php)

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Unternehmensberatung GmbH

 

Office Vienna

Mooslackengasse 17

A-1190 Vienna

Austria

 

Tel.: +43 / 1 / 890 30 43 - 0

Fax.: +43 / 1 / 890 30 43 - 25

Mail: research at sec-consult dot com

www.sec-consult.com

 

SEC Consult conducts periodical information security workshops on ISO

27001/BS 7799 in cooperation with BSI Management Systems. For more

information, please refer to www.sec-consult.com/236.html

 

EOF Johannes Greil / @2007