Multiple Vulnerabilities in Joomla! Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2018-094

DATE(S) ISSUED:

08/29/2018

OVERVIEW:

Multiple vulnerabilities have been discovered in Joomla!, the most severe of which could allow for arbitrary code execution. Joomla! is an open source content management system for websites. Successfully exploiting the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploitation could result in a denial-of-service condition.

THREAT INTELLIGENCE:

There are currently no reports of this vulnerability being exploited in the wild.

SYSTEMS AFFECTED:

• Joomla! CMS versions 1.5.0 through 3.8.11

RISK:

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Joomla!, the most severe of these which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:

• Inadequate checks regarding disabled fields can lead to an ACL violation (CVE-2018-15881)
• Inadequate output filtering on the user profile page could lead to a stored XSS attack (CVE-2018-15880)
• Inadequate checks in the InputFilter class could allow specifically prepared PHAR files to pass the upload filter (CVE-2018-15882)

Successfully exploiting the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the affected application. Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploitation could result in a denial-of-service condition.

RECOMENDATIONS:

We recommend the following actions be taken:

• Apply appropriate patches provided by Joomla! to vulnerable systems immediately after appropriate testing.
• Verify no unauthorized system modifications have occurred on system before applying the patch.
• Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.

REFERENCES: