The Joomla! Forum ™

Download

Demo


Board index » Joomla! 2.5 - Ask Support Questions Here » Security in Joomla! 2.5

Forum rules


Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.



Post new topic This topic is locked, you cannot edit posts or make further replies.  Page 1 of 1
  [ 7 posts ] 
  Print view Previous topic | Next topic 
Author Message
NetworkFu
PostPosted: Wed Jul 04, 2012 9:53 pm 
Joomla! Fledgling
Joomla! Fledgling

Joined: Wed Jul 04, 2012 9:25 pm
Posts: 3
While designing some security around my new site, I started testing for vulnerabilities and came across something a little concerning.

The built-in RSS feed component does not appear to like addition characters injected in the URL.

For example, I accessed my RSS feed as usual, but this time I added a few chars to the syntax of the request: http://[SITE]/?format=feed&type=%2527%2522

You are then presented with a nice tidbit of info regarding the servers root directory structure:

Code:
jos-Error: Unable to load renderer class

JSite -> render() @ /home[OMITTED]/html/index.php:48
JDocumentFeed -> render() @ /home[OMITTED]/html/includes/application.php:271
JDocument -> loadRenderer() @ /home[OMITTED]/html/libraries/joomla/document/feed/feed.php:201
JError :: raiseError() @ /home[OMITTED]/html/libraries/joomla/document/document.php:926
JError :: raise() @ /home[OMITTED]/html/libraries/joomla/error/error.php:251
JError :: throwError() @ /home[OMITTED]/html/libraries/joomla/error/error.php:176
call_user_func_array() @ /home[OMITTED]/html/libraries/joomla/error/error.php:214
JError :: handleCallback()
call_user_func() @ /home[OMITTED]/html/libraries/joomla/error/error.php:765
plgSystemQlue404 :: handleError()
JDocumentFeed -> render() @ /home[OMITTED]/html/plugins/system/qlue404/qlue404.php:122
JDocument -> loadRenderer() @ /home[OMITTED]/html/libraries/joomla/document/feed/feed.php:201
JError :: raiseError() @ /home[OMITTED]/html/libraries/joomla/document/document.php:926
JError :: raise() @ /home[OMITTED]/html/libraries/joomla/error/error.php:251


At first glance a person might say this is an issue with the Qlue404 plugin, however a quick search agains a different server quickly shows this may be relative to Custom Error Page plugins in general:

Code:
jos-Error: Unable to load renderer class

JSite -> dispatch() @ /home[OMITTED]public_html/index.php:42
JComponentHelper :: renderComponent() @ /home[OMITTED]public_html/includes/application.php:197
JComponentHelper :: executeComponent() @ /home[OMITTED]public_html/libraries/joomla/application/component/helper.php:351
require_once() @ /home[OMITTED]public_html/libraries/joomla/application/component/helper.php:383
JController -> execute() @ /home[OMITTED]public_html/components/com_content/content.php:16
ContentController -> display() @ /home[OMITTED]public_html/libraries/joomla/application/component/controller.php:760
JController -> display() @ /home[OMITTED]public_html/components/com_content/controller.php:74
JController -> getView() @ /home[OMITTED]public_html/libraries/joomla/application/component/controller.php:677
JError :: raiseError() @ /home[OMITTED]public_html/libraries/joomla/application/component/controller.php:902
JError :: raise() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:251
JError :: throwError() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:176
call_user_func_array() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:214
JError :: handleCallback()
call_user_func() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:765
plgSystemRedirect :: handleError()
JError :: customErrorPage() @ /home[OMITTED]public_html/plugins/system/redirect/redirect.php:109
JDocumentError -> render() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:798
JDocumentError -> _loadTemplate() @ /home[OMITTED]public_html/libraries/joomla/document/error/error.php:107
require_once() @ /home[OMITTED]public_html/libraries/joomla/document/error/error.php:135
JDocument -> loadRenderer() @ /home[OMITTED]public_html/templates/je-construct-pro/error.php:84
JError :: raiseError() @ /home[OMITTED]public_html/libraries/joomla/document/document.php:926
JError :: raise() @ /home[OMITTED]public_html/libraries/joomla/error/error.php:251


If you would like to see for yourself, run a quick query with the following term:
Code:
jos-Error: Unable to load renderer class JSite -> dispatch() @ /home


Please share your thoughts. I'm curious to see if anyone else has seen this issue before.

Current Joomla! version: 2.5.6
Top
 Profile  
 
mandville
PostPosted: Wed Jul 04, 2012 10:03 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Mon Mar 20, 2006 1:56 am
Posts: 11706
Location: The Girly Side of Joomla in Sussex
Please report all joomla core security concerns in the first case to http://developer.joomla.org/security

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}
Top
 Profile  
 
NetworkFu
PostPosted: Thu Jul 05, 2012 3:14 am 
Joomla! Fledgling
Joomla! Fledgling

Joined: Wed Jul 04, 2012 9:25 pm
Posts: 3
mandville wrote:
Please report all joomla core security concerns in the first case to http://developer.joomla.org/security


Thanks, mandville. I have submitted this information to the email address disclosed on that page.
Top
 Profile  
 
PhilD
PostPosted: Thu Jul 05, 2012 4:27 pm 
User avatar
Joomla! Hero
Joomla! Hero

Joined: Sat Oct 21, 2006 10:20 pm
Posts: 2702
Location: Wisconsin USA
gives me a 500 error

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator
Top
 Profile  
 
brian
PostPosted: Thu Jul 05, 2012 5:45 pm 
User avatar
Joomla! Exemplar
Joomla! Exemplar

Joined: Fri Aug 12, 2005 7:19 am
Posts: 9327
Location: Leeds, UK
@phil gives me a 500 error but the google search shows a LOT of results including some sites of well known developers

_________________
"Exploited yesterday... Hacked tomorrow"
Blog http://brian.teeman.net/
Joomla Hidden Secrets http://hiddenjoomlasecrets.com/
Top
 Profile  
 
NetworkFu
PostPosted: Thu Jul 05, 2012 6:30 pm 
Joomla! Fledgling
Joomla! Fledgling

Joined: Wed Jul 04, 2012 9:25 pm
Posts: 3
Update:

Since yesterday I have completed some additional testing. I have concluded I am able to traverse directories with a variation of this attack. So far, I have only been able to traverse further into the current site. The syntax gets a bit tricky for traversal, and for obvious reasons I will not be posting the code.

I too was able to emulate the 500 error. But only after disabling custom error page plugins. I am not a skilled developer by any means, so I will leave further testing to the pros (JSST).

The more I look at it, the more this points to custom error plugins. Either way, this may require a core fix so the RSS feed component cannot be used to exploit plugins.

Joe
Top
 Profile  
 
mandville
PostPosted: Thu Jul 05, 2012 8:23 pm 
User avatar
Joomla! Master
Joomla! Master

Joined: Mon Mar 20, 2006 1:56 am
Posts: 11706
Location: The Girly Side of Joomla in Sussex
Pending an outcome of investigation by jsst.topic locked.

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic This topic is locked, you cannot edit posts or make further replies.  Page 1 of 1
  [ 7 posts ] 


Board index » Joomla! 2.5 - Ask Support Questions Here » Security in Joomla! 2.5

Who is online

Users browsing this forum: No registered users and 43 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Jump to:  
Powered by phpBB® Forum Software © phpBB Group