The Joomla! Forum ™



Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.



Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 96 posts ]  Go to page 1, 2, 3, 4  Next
Author Message
PostPosted: Sun Jun 18, 2006 2:09 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Fri Sep 23, 2005 3:31 pm
Posts: 197
Location: Italy
sorry for my english, but i'm italian  ;)
i've read this vulnerability in Mambo, and i ask to you if Joomla is protected against that
http://www.securityfocus.com/archive/1/437496


Last edited by stingrey on Wed Jun 28, 2006 3:48 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sun Jun 18, 2006 2:26 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
We have only just become aware of this report and will investigate to see whether this also affects Joomla!



Initial thoughts are that since it is specifically referenced as affecting only Mambo 4.6 RC and not earlier versions of Mambo, than it is likely only to affect the latest installment of Mambo.  That is the vulnerabiity is possibly due to a change made in Mambo 4.6.

Note however, this is only speculation at this stage.  A definiitive answer can only be made with further investigation.



Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Last edited by stingrey on Sun Jun 18, 2006 2:31 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Sun Jun 18, 2006 2:37 pm 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Fri Sep 23, 2005 3:31 pm
Posts: 197
Location: Italy
stingrey wrote:
We have only just become aware of this report and will investigate to see whether this also affects Joomla!



Initial thoughts are that since it is specifically referenced as affecting only Mambo 4.6 RC and not earlier versions of Mambo, than it is likely only to affect the latest installment of Mambo.  That is the vulnerabiity is possibly due to a change made in Mambo 4.6.

Note however, this is only speculation at this stage.  A definiitive answer can only be made with further investigation.



Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652



thanks  8)
(and compliment for the speedy  ;) )


Top
 Profile  
 
PostPosted: Sun Jun 18, 2006 3:31 pm 
Joomla! Guru
Joomla! Guru

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 842
stingrey wrote:
Note that this report has not yet been confirmed by Team Mambo officials as being an actual vulnerability
http://forum.mamboserver.com/showthread.php?t=81652


I can confirm this for Mambo 4.5.2.3!

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
 Profile  
 
PostPosted: Sun Jun 18, 2006 11:07 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:51 pm
Posts: 427
Location: Argentina
+ http://www.securityfocus.com/bid/18492/info

Code:
echo "Joomla <= 1.0.9 'Weblinks' blind SQL injection / admin credentials\r\n";
echo "disclosure exploit (benchmark() vesion)\r\n";
echo "by rgod rgod@autistici.org\r\n";
echo "site: http://retrogod.altervista.org\r\n";


Have a nice day
Gustavo Raúl Aragón

_________________
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 9:41 am 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Fri Aug 19, 2005 2:23 pm
Posts: 2230
Location: The Netherlands
Had a quick look.
I think your safe when you make the following changes:

open /components/com_weblinks/weblinks.php, find:
Code:
/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }




replace it with:
Code:
/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }
   
   // security check to see if link exists in a menu
   $link = 'index.php?option=com_weblinks&task=new';
   $query = "SELECT id"
   . "\n FROM #__menu"
   . "\n WHERE link LIKE '%$link%'"
   . "\n AND published = 1"
   ;
   $database->setQuery( $query );
   $exists = $database->loadResult();
   if ( !$exists ) {                  
      mosNotAuth();
      return;
   }


Than make sure no link exists in your menu to 'index.php?option=com_weblinks&task=new'.
Ofcourse this will not allow users to submit weblinks, but this will do for a lot of websites.

_________________
Adam van Dongen - Developer

- Blocklist, ODT Indexer, EasyFAQ, Easy Guestbook, Easy Gallery, YaNC & Redirect -
http://www.joomla-addons.org - http://www.bandhosting.nl


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 9:48 am 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Fri Aug 19, 2005 2:23 pm
Posts: 2230
Location: The Netherlands
If you do want to allow users to submit links, you can make the following modification:

Find (in the same file as above):
Code:
// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;


Replace with:
Code:
// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;

   if(stristr($row->title, 'SELECT') && stristr($row->title, 'FROM') && stristr($row->title, 'WHERE')){
     echo "<script> alert('Illegal characters in title'); window.history.go(-1); </script>\n";
      exit();
   }


This will pop up an alert if the words 'SELECT', 'FROM' and 'WHERE' are used in the weblink title (which the exploid does).

Note:
I don't know if Joomla is vulerable to the exploid, the code posted above should protect you from the exploid if it should work.

_________________
Adam van Dongen - Developer

- Blocklist, ODT Indexer, EasyFAQ, Easy Guestbook, Easy Gallery, YaNC & Redirect -
http://www.joomla-addons.org - http://www.bandhosting.nl


Last edited by Websmurf on Mon Jun 19, 2006 9:51 am, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 12:27 pm 
Joomla! Fledgling
Joomla! Fledgling

Joined: Mon Jun 19, 2006 12:25 pm
Posts: 1
FYI:
http://secunia.com/advisories/20746/

Exploit:
http://milw0rm.com/exploits/1922

Please let us know how to best patch this in our existing releases? Thanks!


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 1:40 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Wed Oct 19, 2005 2:06 pm
Posts: 17
See also.

http://www.frsirt.com/english/advisories/2006/2417


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 3:23 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Wed Aug 17, 2005 11:26 pm
Posts: 903
A fix for the Mambo vulnerability has been posted on Mambo Guru http://forum.mamboguru.com/showthread.php?t=264
This patch is for 4.6 RC1 and another for 4.5.3h/4.5.4 is coming.  It is possible that the vulnerability affects older versions of Mambo as well.
When the 4.5.3h/4.5.4 patch is posted on the forum it may be useful for Joomla devs to look at (we are not going to be presumptious so wont be posting a fix for 1.0.9 ;) )

_________________
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 3:46 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
This security threat is confirmed in the Joomla! codebase and affects all previous versions of Joomla! including 1.0.9

It is being listed as a [HIGH LEVEL] threat as it can lead to the possibility of confidential user password access information being gained.
Note that this vulnerability is only exploitable by sites that have registered or above frontend access to a site.  If you have a site that does not have frontend access, you should be safe from this vulnerability.



An official fix is pending and will be released shortly.  However, we are currently examining the core to ensure no other similar vulnerability exists elsewhere in the system.

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Last edited by stingrey on Mon Jun 19, 2006 3:49 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 3:51 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Fri Aug 12, 2005 7:19 am
Posts: 10487
Location: Leeds, UK
Ifnyou have frontend access but NOT the ability to submit weblinks are you vulnerable?

_________________
"Exploited yesterday... Hacked tomorrow"
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 3:54 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
Elpie wrote:
A fix for the Mambo vulnerability has been posted on Mambo Guru http://forum.mamboguru.com/showthread.php?t=264
This patch is for 4.6 RC1 and another for 4.5.3h/4.5.4 is coming.  It is possible that the vulnerability affects older versions of Mambo as well.
When the 4.5.3h/4.5.4 patch is posted on the forum it may be useful for Joomla devs to look at (we are not going to be presumptious so wont be posting a fix for 1.0.9 ;) )

I'm sure Mambo users apprieciate this fix being made available.

However, it should be noted that you cannot access the attachement (or any attachment) on the mamboguru forums unless you are registered on the forums - this may limit the access to the fix.

It may be something you might wish to blog about on the guru site to increase its visiblity - but I understand this may be seen as trouble making

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 3:57 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
brian wrote:
Ifnyou have frontend access but NOT the ability to submit weblinks are you vulnerable?

Unfortunately yes you are still vulnerable.

However, if you impelment websmurf's suggestion here:
http://forum.joomla.org/index.php/topic ... #msg366017

This will stop this hole in this instance, where you do not allow weblinks submission.

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 4:21 pm 
User avatar
Joomla! Guru
Joomla! Guru

Joined: Wed Aug 17, 2005 11:26 pm
Posts: 903
stingrey wrote:
However, it should be noted that you cannot access the attachement (or any attachment) on the mamboguru forums unless you are registered on the forums - this may limit the access to the fix.


Sadly, this is the way it has to be :( There have been abuses of copyright and until certain parties stop stripping copyright out of code, we are not comfortable with just putting the patches into our file download area. Any Mambo users who don't want to register on the forum (and there are many who don't want to be seen to be there, which is why we allow people to login as hidden users) can email me and I will send you the patches.

_________________
For Mambo assistance: http://forum.mambo-foundation.org
Open Source Research & Best Practice: http://osprojects.info


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 4:35 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
Elpie wrote:
Sadly, this is the way it has to be :( There have been abuses of copyright and until certain parties stop stripping copyright out of code, we are not comfortable with just putting the patches into our file download area.

This is unfortunate, anway I'm sure there are users who appreciate the effort.

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 4:44 pm 
Joomla! Apprentice
Joomla! Apprentice

Joined: Sat Oct 22, 2005 7:12 pm
Posts: 33
Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

Mike


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 4:52 pm 
Joomla! Guru
Joomla! Guru

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 842
MikeFossati wrote:
Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.


Unfortunately, securityfocus.com doesn't provide much information. If that listing is based on http://www.securityfocus.com/archive/1/436707 (they link it as a reference), then that's not going to work. I would say that's a hoax.

_________________
We may not be able to control the wind, but we can always adjust our sails


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 5:00 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
friesengeist wrote:
MikeFossati wrote:
Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.


Unfortunately, securityfocus.com doesn't provide much information. If that listing is based on http://www.securityfocus.com/archive/1/436707 (they link it as a reference), then that's not going to work. I would say that's a hoax.

Yes we are aware of this report and as pointed out by [friesengeist] there is so little information it is simply not possible to test the veracity/accuracy of the report.

We have even tried to contact the original reporter via the email listed.



However, at this stage we have to list this report as being UNCONFIRMED and possibly false.

Of course if more information can be provided we will examine the issue again.

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 5:12 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:51 pm
Posts: 427
Location: Argentina
¿Hoax?


Tested in localhost : Joomla 1.0.9

Code:
'
removed for security reasons
--------------------------------------------------------------------


Quote:
Post subject: joomla blind sql injection
Posted: Jun 17, 2006 - 01:39 PM
Google's Worst Nightmare

rgod
Joined: Apr 06, 2005
Posts: 2533
Location: Italy
Status: Offline
dork:

http://www.google.com/search?q=%22jooml ... =&filter=0

maybe someone could catch more results, dunno

modified the mambo exploit to work against joomla:

http://retrogod.altervista.org/joomla_109_sql.html



Link: http://johnny.ihackstuff.com/index.php? ... 6770#16770


Have a nice day
Gustavo Raúl Aragón

_________________
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org


Last edited by gustavo on Mon Jun 19, 2006 5:43 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 5:19 pm 
Joomla! Guru
Joomla! Guru

Joined: Sat Sep 10, 2005 10:31 pm
Posts: 842
gustavo wrote:
¿Hoax?

Tested in localhost : Joomla 1.0.9

Code:
removed for security
--------------------------------------------------------------------



Have you read that I was referring to
MikeFossati wrote:
Securityfocus is listing another security issue related to "IncludePath Remote File Include Vulnerability" here: http://www.securityfocus.com/bid/18363/. Not sure if this has been addressed yet or not.

this post?

I know that the [mod note: removed] stuff does work, I also confirmed yesterday that Joomla is vulnerable. However, I didn't want to make the details public, so I send them to the core devs per mail.

_________________
We may not be able to control the wind, but we can always adjust our sails


Last edited by nathandiehl on Mon Jun 19, 2006 5:32 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 5:28 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:51 pm
Posts: 427
Location: Argentina
ok.. thanks friesengeist ;)

Have a nice day
Gustavo Raúl Aragón

_________________
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org


Top
 Profile  
 
PostPosted: Mon Jun 19, 2006 5:32 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
gustavo wrote:
¿Hoax?

Tested in localhost : Joomla 1.0.9

As i stated here:
http://forum.joomla.org/index.php/topic ... #msg366480
the original security report:
Joomla! "Name" SQL Injection Vulnerability
http://secunia.com/advisories/20746
has been CONFIRMED



However this issue:
Joomla IncludePath Remote File Include Vulnerability
http://www.securityfocus.com/bid/18363/
is UNCONFIRMED

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 10:17 am 
Joomla! Fledgling
Joomla! Fledgling

Joined: Tue Jun 20, 2006 10:12 am
Posts: 1
i got several other solutions for the exploit:

check http://macosbrain.ath.cx/wordpress/2006 ... n-exploit/

ps: the site is in german but i think you should understand it.


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 11:10 am 
User avatar
Joomla! Enthusiast
Joomla! Enthusiast

Joined: Fri Sep 23, 2005 3:31 pm
Posts: 197
Location: Italy
i'm happy to see the utility of my thread  ;)


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 6:01 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Thu Aug 25, 2005 5:48 pm
Posts: 2860
Location: Geneva mostly
Rey, any idea about ETA for the patch? thanks

Other question: can this still be accessed if there's no published link to com_weblinks? by using the option in the url?

_________________
Sometimes one pays most for the things one gets for nothing.
The important thing is not to stop questioning. Curiosity has its own reason for existing. AE
http://joomla15.[URL banned].com for J! 1.5 screenshots
http://www.eyezberg.com


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 6:08 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:51 pm
Posts: 427
Location: Argentina
Oficial solution for SQL injection .. 1.0.10 ? for when?

Svn 1.0.x
Quote:
** HIGH Level Threats fixed in 1.0.10

A1 Unvalidated Input
* A1 - Secured `Remember Me` functionality against SQL injection attacks
* A1 - Secured `Related Items` Module against SQL injection attacks
* A1 - Secured `Weblinks` submission against SQL injection attacks

** LOW Level Threats fixed in 1.0.10

A1 Unvalidated Input
* A1 - Hardened Frontend submission forms against spoofing


Have a nice day
Gustavo Raúl Aragón

_________________
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org


Last edited by gustavo on Tue Jun 20, 2006 6:10 pm, edited 1 time in total.

Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 6:17 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Mon Aug 15, 2005 4:36 pm
Posts: 2756
Location: Marikina, Metro Manila, Philippines
gustavo wrote:
Oficial solution for SQL injection .. 1.0.10 ? for when?

We are working as quickly as possible to complete and release 1.0.10 as soon as possible - at last check my watch said 2am.

_________________
Rey Gigataras
http://www.wizmediateam.com <-- great team of talented Web Designers and Programmers!
http://about.me/reygigataras <-- About Me :)
Partner, Business Development & Project Manager, Event Manager, Sports Coach :D


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 6:21 pm 
User avatar
Joomla! Explorer
Joomla! Explorer

Joined: Fri Aug 19, 2005 12:51 pm
Posts: 427
Location: Argentina
Very thanks ray for fast reply! ;)

Have a nice day
Gustavo Raúl Aragón

_________________
Comunidad Joomla: Maintenance, support, translation and distribution for the Joomla!. Help site online. Member of the Spanish [es_ES] Joomla Translation Team. http://comunidadjoomla.org


Top
 Profile  
 
PostPosted: Tue Jun 20, 2006 7:04 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Thu Aug 25, 2005 5:48 pm
Posts: 2860
Location: Geneva mostly
Rey, go to bed! Tomorrow's as good as today!

Anyone knows / tried if this threat is workable by just appending stuff to index.php?option=...

_________________
Sometimes one pays most for the things one gets for nothing.
The important thing is not to stop questioning. Curiosity has its own reason for existing. AE
http://joomla15.[URL banned].com for J! 1.5 screenshots
http://www.eyezberg.com


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  [ 96 posts ]  Go to page 1, 2, 3, 4  Next



Who is online

Users browsing this forum: No registered users and 14 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group