|
|
============================================INTERNET SECURITY AUDITORS ALERT 2009-009
- Original release date: July 21st, 2009
- Last revised: July 23rd, 2009
- Discovered by: Juan Galiana Lara
- Severity: 5/10 (CVSS Base Score)
============================================
I. VULNERABILITY
-------------------------
Joomla! < 1.5.12 Multiple Full Path Disclosure vulnerabilities
II. BACKGROUND
-------------------------
Joomla! is an award-winning content management system (CMS), which
enables you to build Web sites and powerful online applications. Many
aspects, including its ease-of-use and extensibility, have made
Joomla! the most popular Web site software available. Best of all,
Joomla! is an open source solution that is freely available to everyone.
III. DESCRIPTION
-------------------------
This vulnerability could allow a malicious user to view the internal
path information of the host due to some files were missing the check
for JEXEC.
IV. PROOF OF CONCEPT
-------------------------
The attacker can get the full path of the instalation of Joomla!
browsing to any of this urls:
http://example.com/joomla-1.5.12/libraries/joomla/utilities/compat/php50x.php
http://example.com/joomla-1.5.12/libraries/joomla/client/ldap.php
http://example.com/joomla-1.5.12/libraries/joomla/html/html/content.php
The information obtained contais the full path to the files:
Parse error: syntax error, unexpected T_CLONE, expecting
T_STRING in
/var/www/joomla-1.5.12/libraries/joomla/utilities/compat/php50x.php
on line 100
Fatal error: Class 'JObject' not found in
/var/www/joomla-1.5.12/libraries/joomla/client/ldap.php on line
21
Fatal error: Class 'JLoader' not found in
/var/www/joomla-1.5.12/libraries/joomla/html/html/content.php
on line 15
V. BUSINESS IMPACT
-------------------------
Full path disclosure vulnerabilities enables an attacker to know the
path to the web root. This information can be used in order to launch
further attacks.
VI. SYSTEMS AFFECTED
-------------------------
Joomla! versions prior and including 1.5.12 are vulnerable.
VII. SOLUTION
-------------------------
Upgrade to version 1.5.13
VIII. REFERENCES
-------------------------
http://www.joomla.org
http://www.isecauditors.com
IX. CREDITS
-------------------------
This vulnerability has been discovered
by Juan Galiana Lara (jgaliana (at) isecauditors (dot) com).
X. REVISION HISTORY
-------------------------
July 21, 2009: Initial release.
July 23, 2009: Last revision.
XI. DISCLOSURE TIMELINE
-------------------------
July 21, 2009: Discovered by Internet Security Auditors.
July 21, 2009: Vendor contacted.
July 22, 2009: Joomla! publish update. Great job.
July 24, 2009: Advisory published.
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
Internet Security Auditors accepts no responsibility for any damage
caused by the use or misuse of this information.