JOOMLA! XSS VULNERABILITIES

-- Riyaz Ahemed Walikar

Background

​

• Joomla! - Content Management System
• PHP, MySQL
• Ease of design and publishing
• Admin Module
• User pages

​

Examples

• http://www.danone.com/?lang=en
• http://www.itwire.com/
• http://vho.nasa.gov/
• http://new.lincolncenter.org/live/
• http://www.spl.usace.army.mil/cms/index.php
• http://tatanano.inservices.tatamotors.com/tatamotors/index.php

​

Tools

• Local installation
• Firefox + web developer addon
• Patience!

​

HowTo

• Install Joomla! locally
• Open in Firefox
• Login to Admin Module
• Change POSTs to GETs
• Insert script tags and alert (‘xss’) on various URL parameters
• If (alert=true) { print “yay!!”}

​

​

Technojabble

• The search parameter
• Exploit code
• " onmousemove=alert('xss') />
• " onmousemove=alert(document.cookie) />
• " onmousemove=window.location.assign(url) />
• 17 component modules
• All versions prior to 1.5.18
• Phishing, malware download, cookie

stealing etc.

​

​

Timeline

• Discovered between May 10^th -12^th
• Informed JSST on May 13^th
• Acknowledged on May 13^th
• Constant updates
• Fixed version release May 28^th
• Fixed Version 1.5.18 [latest stable]
• Bugtraq and Secunia June 2^nd
• NVD June 4^th

​

​

​

References

• CONFIRM
• http://developer.joomla.org/security/news/314-20100501-core-xss-vulnerabilities-in-back-end.html

​

• CVE-2010-1649
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1649

​

• BID: 40444
• www.securityfocus.com/bid/40444

​

​

​

References

• OSVDB: 65011
• http://www.osvdb.org/65011

​

• SECUNIA: 39964
• http://secunia.com/advisories/39964

​

• Keeda ID: K-31

​

​

​

Thank You!

riyazwalikar@gmail.com