[FIXED in 1.0.10] SQL Injection vulnerability Joomla! 1.0.9 Stable

Bettinz · **Posted:** Sun Jun 18, 2006 2:09 pm

sorry for my english, but i'm italian

i've read this vulnerability in Mambo, and i ask to you if Joomla is protected against that
http://www.securityfocus.com/archive/1/437496

stingrey · **Posted:** Sun Jun 18, 2006 2:26 pm

We have only just become aware of this report and will investigate to see whether this also affects Joomla!

Initial thoughts are that since it is specifically referenced as affecting only Mambo 4.6 RC and not earlier versions of Mambo, than it is likely only to affect the latest installment of Mambo. That is the vulnerabiity is possibly due to a change made in Mambo 4.6.

Note however, this is only speculation at this stage. A definiitive answer can only be made with further investigation.

Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652

Bettinz · **Posted:** Sun Jun 18, 2006 2:37 pm

stingrey wrote:

We have only just become aware of this report and will investigate to see whether this also affects Joomla!

Initial thoughts are that since it is specifically referenced as affecting only Mambo 4.6 RC and not earlier versions of Mambo, than it is likely only to affect the latest installment of Mambo. That is the vulnerabiity is possibly due to a change made in Mambo 4.6.

Note however, this is only speculation at this stage. A definiitive answer can only be made with further investigation.

Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652

thanks

(and compliment for the speedy

)

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 842

stingrey wrote:

Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652

I can confirm this for Mambo 4.5.2.3!

gustavo · **Posted:** Sun Jun 18, 2006 11:07 pm

+ http://www.securityfocus.com/bid/18492/info

Code:

echo "Joomla <= 1.0.9 'Weblinks' blind SQL injection / admin credentials\r\n";
echo "disclosure exploit (benchmark() vesion)\r\n";
echo "by rgod rgod@autistici.org\r\n";
echo "site: http://retrogod.altervista.org\r\n";

Have a nice day
Gustavo Raúl Aragón

Websmurf · **Posted:** Mon Jun 19, 2006 9:41 am

Had a quick look.
I think your safe when you make the following changes:

open /components/com_weblinks/weblinks.php, find:

Code:

/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }

replace it with:

Code:

/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }
   
   // security check to see if link exists in a menu
   $link = 'index.php?option=com_weblinks&task=new';
   $query = "SELECT id"
   . "\n FROM #__menu"
   . "\n WHERE link LIKE '%$link%'"
   . "\n AND published = 1"
   ;
   $database->setQuery( $query );
   $exists = $database->loadResult();
   if ( !$exists ) {                  
      mosNotAuth();
      return;
   }

Than make sure no link exists in your menu to 'index.php?option=com_weblinks&task=new'.
Ofcourse this will not allow users to submit weblinks, but this will do for a lot of websites.

Websmurf · **Posted:** Mon Jun 19, 2006 9:48 am

If you do want to allow users to submit links, you can make the following modification:

Find (in the same file as above):

Code:

// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;

Replace with:

Code:

// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;

   if(stristr($row->title, 'SELECT') && stristr($row->title, 'FROM') && stristr($row->title, 'WHERE')){
     echo "<script> alert('Illegal characters in title'); window.history.go(-1); </script>\n";
      exit();
   }

This will pop up an alert if the words 'SELECT', 'FROM' and 'WHERE' are used in the weblink title (which the exploid does).

Note:
I don't know if Joomla is vulerable to the exploid, the code posted above should protect you from the exploid if it should work.

meowcat · **Joined:** Mon Jun 19, 2006 12:25 pm **Posts:** 1

FYI:
http://secunia.com/advisories/20746/

Exploit:
http://milw0rm.com/exploits/1922

Please let us know how to best patch this in our existing releases? Thanks!

jazzyj · **Joined:** Wed Oct 19, 2005 2:06 pm **Posts:** 17

See also.

http://www.frsirt.com/english/advisories/2006/2417

Elpie · **Joined:** Wed Aug 17, 2005 11:26 pm **Posts:** 903

A fix for the Mambo vulnerability has been posted on Mambo Guru http://forum.mamboguru.com/showthread.php?t=264
This patch is for 4.6 RC1 and another for 4.5.3h/4.5.4 is coming. It is possible that the vulnerability affects older versions of Mambo as well.
When the 4.5.3h/4.5.4 patch is posted on the forum it may be useful for Joomla devs to look at (we are not going to be presumptious so wont be posting a fix for 1.0.9

)

stingrey · **Posted:** Mon Jun 19, 2006 3:46 pm

This security threat is confirmed in the Joomla! codebase and affects all previous versions of Joomla! including 1.0.9

It is being listed as a [HIGH LEVEL] threat as it can lead to the possibility of confidential user password access information being gained.
Note that this vulnerability is only exploitable by sites that have registered or above frontend access to a site. If you have a site that does not have frontend access, you should be safe from this vulnerability.

An official fix is pending and will be released shortly. However, we are currently examining the core to ensure no other similar vulnerability exists elsewhere in the system.

brian · **Posted:** Mon Jun 19, 2006 3:51 pm

Ifnyou have frontend access but NOT the ability to submit weblinks are you vulnerable?

stingrey · **Posted:** Mon Jun 19, 2006 3:54 pm

Elpie wrote:

A fix for the Mambo vulnerability has been posted on Mambo Guru http://forum.mamboguru.com/showthread.php?t=264
This patch is for 4.6 RC1 and another for 4.5.3h/4.5.4 is coming. It is possible that the vulnerability affects older versions of Mambo as well.
When the 4.5.3h/4.5.4 patch is posted on the forum it may be useful for Joomla devs to look at (we are not going to be presumptious so wont be posting a fix for 1.0.9

)

I'm sure Mambo users apprieciate this fix being made available.

However, it should be noted that you cannot access the attachement (or any attachment) on the mamboguru forums unless you are registered on the forums - this may limit the access to the fix.

It may be something you might wish to blog about on the guru site to increase its visiblity - but I understand this may be seen as trouble making

stingrey · **Posted:** Mon Jun 19, 2006 3:57 pm

brian wrote:

Ifnyou have frontend access but NOT the ability to submit weblinks are you vulnerable?

Unfortunately yes you are still vulnerable.

However, if you impelment websmurf's suggestion here:
http://forum.joomla.org/index.php/topic ... #msg366017

This will stop this hole in this instance, where you do not allow weblinks submission.

Elpie · **Joined:** Wed Aug 17, 2005 11:26 pm **Posts:** 903

stingrey wrote:

However, it should be noted that you cannot access the attachement (or any attachment) on the mamboguru forums unless you are registered on the forums - this may limit the access to the fix.

Sadly, this is the way it has to be

There have been abuses of copyright and until certain parties stop stripping copyright out of code, we are not comfortable with just putting the patches into our file download area. Any Mambo users who don't want to register on the forum (and there are many who don't want to be seen to be there, which is why we allow people to login as hidden users) can email me and I will send you the patches.

stingrey · **Posted:** Mon Jun 19, 2006 4:35 pm

Elpie wrote:

Sadly, this is the way it has to be

There have been abuses of copyright and until certain parties stop stripping copyright out of code, we are not comfortable with just putting the patches into our file download area.

This is unfortunate, anway I'm sure there are users who appreciate the effort.

MikeFossati · **Joined:** Sat Oct 22, 2005 7:12 pm **Posts:** 33

Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

Mike

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 842

MikeFossati wrote:

Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

Unfortunately, securityfocus.com doesn't provide much information. If that listing is based on http://www.securityfocus.com/archive/1/436707 (they link it as a reference), then that's not going to work. I would say that's a hoax.

stingrey · **Posted:** Mon Jun 19, 2006 5:00 pm

friesengeist wrote:

MikeFossati wrote:

Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

Unfortunately, securityfocus.com doesn't provide much information. If that listing is based on http://www.securityfocus.com/archive/1/436707 (they link it as a reference), then that's not going to work. I would say that's a hoax.

Yes we are aware of this report and as pointed out by [friesengeist] there is so little information it is simply not possible to test the veracity/accuracy of the report.

We have even tried to contact the original reporter via the email listed.

However, at this stage we have to list this report as being UNCONFIRMED and possibly false.

Of course if more information can be provided we will examine the issue again.

gustavo · **Posted:** Mon Jun 19, 2006 5:12 pm

¿Hoax?

Tested in localhost : Joomla 1.0.9

Code:

'
removed for security reasons
--------------------------------------------------------------------

Quote:

Post subject: joomla blind sql injection
Posted: Jun 17, 2006 - 01:39 PM
Google's Worst Nightmare

rgod
Joined: Apr 06, 2005
Posts: 2533
Location: Italy
Status: Offline
dork:

http://www.google.com/search?q=%22jooml ... =&filter=0

maybe someone could catch more results, dunno

modified the mambo exploit to work against joomla:

http://retrogod.altervista.org/joomla_109_sql.html

Link: http://johnny.ihackstuff.com/index.php? ... 6770#16770

Have a nice day
Gustavo Raúl Aragón

friesengeist · **Joined:** Sat Sep 10, 2005 10:31 pm **Posts:** 842

gustavo wrote:

¿Hoax?

Tested in localhost : Joomla 1.0.9

Code:

removed for security
--------------------------------------------------------------------

Have you read that I was referring to

MikeFossati wrote:

Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

this post?

I know that the [mod note: removed] stuff does work, I also confirmed yesterday that Joomla is vulnerable. However, I didn't want to make the details public, so I send them to the core devs per mail.

gustavo · **Posted:** Mon Jun 19, 2006 5:28 pm

ok.. thanks friesengeist

Have a nice day
Gustavo Raúl Aragón

stingrey · **Posted:** Mon Jun 19, 2006 5:32 pm

gustavo wrote:

¿Hoax?

Tested in localhost : Joomla 1.0.9

As i stated here:
http://forum.joomla.org/index.php/topic ... #msg366480
the original security report:
Joomla! "Name" SQL Injection Vulnerability
http://secunia.com/advisories/20746
has been CONFIRMED

However this issue:
Joomla IncludePath Remote File Include Vulnerability
http://www.securityfocus.com/bid/18363/
is UNCONFIRMED

macosbrain · **Joined:** Tue Jun 20, 2006 10:12 am **Posts:** 1

i got several other solutions for the exploit:

check http://macosbrain.ath.cx/wordpress/2006 ... n-exploit/

ps: the site is in german but i think you should understand it.

Bettinz · **Posted:** Tue Jun 20, 2006 11:10 am

i'm happy to see the utility of my thread

eyezberg · **Posted:** Tue Jun 20, 2006 6:01 pm

Rey, any idea about ETA for the patch? thanks

Other question: can this still be accessed if there's no published link to com_weblinks? by using the option in the url?

gustavo · **Posted:** Tue Jun 20, 2006 6:08 pm

Oficial solution for SQL injection .. 1.0.10 ? for when?

Svn 1.0.x

Quote:

** HIGH Level Threats fixed in 1.0.10

A1 Unvalidated Input
* A1 - Secured `Remember Me` functionality against SQL injection attacks
* A1 - Secured `Related Items` Module against SQL injection attacks
* A1 - Secured `Weblinks` submission against SQL injection attacks

** LOW Level Threats fixed in 1.0.10

A1 Unvalidated Input
* A1 - Hardened Frontend submission forms against spoofing

Have a nice day
Gustavo Raúl Aragón

stingrey · **Posted:** Tue Jun 20, 2006 6:17 pm

gustavo wrote:

Oficial solution for SQL injection .. 1.0.10 ? for when?

We are working as quickly as possible to complete and release 1.0.10 as soon as possible - at last check my watch said 2am.

gustavo · **Posted:** Tue Jun 20, 2006 6:21 pm

Very thanks ray for fast reply!

Have a nice day
Gustavo Raúl Aragón

eyezberg · **Posted:** Tue Jun 20, 2006 7:04 pm

Rey, go to bed! Tomorrow's as good as today!

Anyone knows / tried if this threat is workable by just appending stuff to index.php?option=...

Welcome to Joomla!

Recent Joomla! News

Support Joomla!

What Is Joomla?

Joomla! for Business

Joomla! for Developers

Learn more about Joomla!

Connect!

Support!

Read!

Get involved with Joomla!

Directories

Developers

Download Joomla! 2.5

Download Joomla! 3.1

Getting Started with Joomla!

Internationalization

The Joomla! Forum ™

Forum rules

[FIXED in 1.0.10] SQL Injection vulnerability Joomla! 1.0.9 Stable

Who is online